warn when a plugin's packages would block its own updates

update is a git pull and then the ordinary install path, so the npm step is
picked up for free — a plugin that adds a dependency in a later version gets it
installed on update, with no second implementation to drift.

but pullPlugin refuses on ANY uncommitted change, and node_modules/ that
nothing ignores is one. so a plugin shipping package.json without ignoring it
installs perfectly once and can then never be updated again: the button reports
"N uncommitted changes" forever, about a directory the platform itself created,
and nobody seeing that message has a reason to connect it to a package.json
from three versions ago.

every plugin that exists today ignores node_modules, which is luck rather than
a rule — this makes it a checked one.

asked with `git check-ignore` rather than by reading .gitignore: the rule may
be nested, global, or in .git/info/exclude, and all three count.

warned, not fixed. writing into the plugin's own .gitignore would be the
platform editing a repository it does not own, and would itself dirty the
checkout — which is the exact thing being avoided.

src/servers/plugins/install.ts

@@ -24,7 +24,7 @@ import { generatePluginSchemas, pushPluginSchema } from './schema';
 import { declaredTables, dropTables, existingTables } from './tables';
 import type { OnLog } from './run-logged';
 import { installDependencies, installRelease, manualInstallHint, reportDependencies, stillMissing } from './os-deps';
-import { installNpmDependencies, npmManifestFor, verifyNpmDependencies } from './npm-deps';
+import { installNpmDependencies, npmManifestFor, npmWouldBlockUpdates, verifyNpmDependencies } from './npm-deps';
 import { mountPrefix, type DiscoveredPlugin } from './manifest';
 
 // The install runner: the four verbs, each as a short ordered list of effects.
@@ -295,6 +295,19 @@ export async function installPlugin(
         };
       }
       await step(steps, onStep, 'packages: installed and resolvable');
+
+      // Said now, while there is something to be done about it. `pullPlugin` refuses on any uncommitted
+      // change, so an unignored `node_modules/` turns the Update button into a permanent "N uncommitted
+      // changes" about a directory the platform created — and the person seeing that message has no
+      // reason to connect it to a package.json shipped three versions ago.
+      if (await npmWouldBlockUpdates(plugin)) {
+        await step(
+          steps,
+          onStep,
+          'packages: WARNING — this plugin does not ignore node_modules/, so Update will refuse as dirty. ' +
+            'Add `node_modules/` to its .gitignore.',
+        );
+      }
     }
 
     if (plugin.schema) {