Move PluginService into core.plugin and make it own tenant-scoped plugin model provider cache reads, writes, and invalidation.
Inject PluginService into PluginModelRuntime and remove the request-scoped provider cache so install, uninstall, and upgrade flows share the same cache owner.