Enhanced plugin isolation tightens the plugin sandbox boundary in the 2026.6.1 line

What this changes for operators

• Enhanced plugin isolation changes the sandbox boundary around plugins, including the externalized Tokenjuice and GitHub Copilot plugins now run as separate plugins.
• Operators running third-party or externalized plugins should re-test plugin behavior against the tightened isolation, since capabilities previously available in-process may now be constrained.
• Single runtime-admin decision: verify plugins still function under the new isolation after upgrade.