fix(plugins): close LA5 host lifecycle review

src/AcDream.Launcher.Core/Launching/SessionConfigComposer.cs

@@ -74,7 +74,9 @@ public static class SessionConfigComposer
             Character = selector,
             Policy = policy,
             Credential = new SessionCredentialDescriptor(),
-            Plugins = character.Plugins.Count > 0 ? [.. character.Plugins] : null,
+            // LA5 distinguishes an omitted allow-list (load all, preserving
+            // the developer flow) from an explicit empty list (load none).
+            Plugins = [.. character.Plugins],
             LoginCommands = character.LoginCommands.Count > 0
                 ? [.. character.LoginCommands]
                 : null,
@@ -107,9 +109,9 @@ public static class SessionConfigComposer
     /// §LA3 review finding F2): the session carries <c>mode: "probe"</c>,
     /// no <c>character</c> selector, and no <c>policy</c> — the host
     /// reports the account's character roster over the status stream and
-    /// exits without entering the world. <c>plugins</c>/<c>loginCommands</c>
-    /// don't apply to a probe and are always omitted, exactly like an
-    /// empty configured set on a normal session.
+    /// exits without entering the world. Probes carry an explicit empty
+    /// <c>plugins</c> allow-list so a plugin installed on the machine cannot
+    /// run merely because the probe has no character-level plugin settings.
     /// </summary>
     public static ComposedSessionConfig ComposeProbe(
         ServerProfile server,
@@ -139,7 +141,7 @@ public static class SessionConfigComposer
             Character = null,
             Policy = null,
             Credential = new SessionCredentialDescriptor(),
-            Plugins = null,
+            Plugins = [],
             LoginCommands = null,
             LoginCommandDelayMs = null,
             StatusFile = statusFilePath,