wfctl plugin conformance should preserve failure diagnostics and ship in release

[intel352]

Problem

While probing IaC plugins from origin/main, two conformance-tooling gaps showed up.

1. Latest released wfctl v0.51.2 does not include plugin conformance; plugin CI currently has to build from a Workflow commit.
2. Failure evidence for launch-time typed-IaC failures omits the human error message in some cases. AWS/Azure stderr tail only included go-plugin address logs while the CLI returned error: iac: plugin uses legacy InvokeService dispatch removed in workflow v1.0.0.
3. A clean source worktree build stamped evidence wfctlVersion as v0.22.8-0.20260510180701-a851625d3bf0+dirty, which is misleading for post-merge conformance evidence.

Expected behavior

• Release a wfctl version containing plugin conformance and plugin-registry compatibility support, or publish a documented setup-wfctl snapshot pin path.
• Evidence for failed conformance should include a bounded error or failureReason field in addition to stderr tail.
• Source-built wfctl version stamping should report the actual module commit/tag and avoid dirty markers for clean worktrees.

Why

Plugin repos need one stable command for compatibility gates. If failures omit the actionable message, maintainers have to reproduce locally before knowing whether the break is legacy dispatch, missing executable, handshake failure, or a typed service registration gap.

Related

• wfctl plugin conformance artifact mode should discover release binary names #632 covers artifact executable discovery.
• PR Fix plugin conformance source build packages #630 added source --build-package.
• PR Accept engine pseudo-versions in plugin evidence #631 allowed pseudo engine versions in compatibility evidence.

[intel352]

Antagonistic rollout review flagged one addition: until artifact mode and a released wfctl carry conformance, plugin repo CI using source-mode --build-package should be treated as pre-release smoke, not release-artifact compatibility evidence. Registry compatibility should only enforce artifact-bound evidence once #632 is fixed or the release artifact shape is otherwise proven.