docs: record plugin enablement safeguard limits [skip ci]

Describe landed 792817bfcb: recheck the staged snapshot and refuse a changed
review generation or trust receipt under the existing state lock.

Verified the retained Mac stale-enable log (1 passed, 201 filtered), monitor,
pre/post capture and matching registry/tests/Cargo.lock hashes. Separately
attribute the reported Linux 202 passed/1 ignored result to its earlier-base
run; its raw logs remain with Codewhalebot, not this local receipt. Later
net/config changes were absent from that Linux tree.

Keep automatic restoration unfinished, the snapshot check point-in-time,
filesystem races open, and production stage-disappearance/final-candidate
qualification unclaimed. Preserve the consolidated website Unreleased entry.

Verified changelog sync/check, facts derivation/drift and scoped whitespace;
no generated metadata delta. All 25 v12 manifest entries matched immediately
before explicit two-file staging. No native build, new test, hosted CI or
deployment was run for this docs slice.

CHANGELOG.md

@@ -252,6 +252,13 @@ until the matching tag, packages, checksums, and release assets exist.
 
 ### Fixed
 
+- **Plugin enablement revalidates its review:** enabling rechecks the staged
+  snapshot and, under the existing state lock, refuses a changed review
+  generation or trust receipt. The macOS stale-enable check passed (1/1);
+  a separate Linux run reported 202 passed and one ignored on an earlier base
+  with matching plugin files and lockfile. Snapshot checking is point-in-time;
+  automatic restoration is unfinished and filesystem races remain open. A
+  stage-disappearance regression and the final candidate remain unqualified.
 - **Plugin status and UI admission:** an enabled, trusted plugin whose reviewed
   runtime snapshot is missing or invalid now reports
   `runtime-snapshot-unavailable`. Both plugin UI metadata and assets require a

crates/tui/CHANGELOG.md

@@ -252,6 +252,13 @@ until the matching tag, packages, checksums, and release assets exist.
 
 ### Fixed
 
+- **Plugin enablement revalidates its review:** enabling rechecks the staged
+  snapshot and, under the existing state lock, refuses a changed review
+  generation or trust receipt. The macOS stale-enable check passed (1/1);
+  a separate Linux run reported 202 passed and one ignored on an earlier base
+  with matching plugin files and lockfile. Snapshot checking is point-in-time;
+  automatic restoration is unfinished and filesystem races remain open. A
+  stage-disappearance regression and the final candidate remain unqualified.
 - **Plugin status and UI admission:** an enabled, trusted plugin whose reviewed
   runtime snapshot is missing or invalid now reports
   `runtime-snapshot-unavailable`. Both plugin UI metadata and assets require a