feat(plugin-system): harden P0 safety with workflow timeout, service ACL, and contract validation

- enforce step timeout/cancellation in workflow engine
- add caller authorization boundary for cross-plugin service calls
- validate params_schema and return_schema at runtime

src/plugin_system/core/component_registry.py

@@ -274,6 +274,23 @@ class ComponentRegistry:
             logger.error(f"移除组件 {component_name} 时发生错误: {e}")
             return False
 
+    async def remove_components_by_plugin(self, plugin_name: str) -> int:
+        """移除某插件注册的所有组件。"""
+        targets = [
+            (component_info.name, component_info.component_type)
+            for component_info in self._components.values()
+            if component_info.plugin_name == plugin_name
+        ]
+
+        removed_count = 0
+        for component_name, component_type in targets:
+            if await self.remove_component(component_name, component_type, plugin_name):
+                removed_count += 1
+
+        if removed_count:
+            logger.info(f"已移除插件 {plugin_name} 的组件数量: {removed_count}")
+        return removed_count
+
     def remove_plugin_registry(self, plugin_name: str) -> bool:
         """移除插件注册信息