[hakeemRash]

Summary

• hkm plugins install/enable/update never replace a file the project already has. When a plugin's copy of a published file (config, migration, view, layout, translation) differs, the project's file is kept and the plugin's version is written beside it as <file>.updated. Before, a file still exactly as it was last published was refreshed in place, so hkm plugins install --latest rewrote configuration, views and layouts a project had built on. --overwrite still replaces them for one update run.
• The side copy is now <file>.updated (was <file>.plugin-new); a leftover .plugin-new is removed once the file matches the plugin again.
• install lists every kept file with its .updated suggestion, and counts only the assets it actually wrote.
• The kernel gate refuses a plugin only when the running kernel is older than the plugin's floor. A kernel above the plugin's range (~1.17 on 1.19, ^1.13 on 2.0) installs it with a warning instead of blocking it.

Test plan

• zig build test with the pinned toolchain (0.17.0-dev.657+2faf8debf): 8/8 steps, all tests pass, including new decideAsset and meetsFloor cases
• zig build --release=small for x86_64-linux-gnu, x86_64-windows-gnu, aarch64-macos, x86_64-macos
• hkm plugins update --dry-run on a real project (hkmvote): its layout, translations and an applied migration are reported as kept with *.updated suggestions; nothing is refreshed and no file changes
• A real install against a plugin whose kernel range excludes the running kernel (not run)