warn when a plugin's packages would block its own updates

update is a git pull and then the ordinary install path, so the npm step is
picked up for free — a plugin that adds a dependency in a later version gets it
installed on update, with no second implementation to drift.

but pullPlugin refuses on ANY uncommitted change, and node_modules/ that
nothing ignores is one. so a plugin shipping package.json without ignoring it
installs perfectly once and can then never be updated again: the button reports
"N uncommitted changes" forever, about a directory the platform itself created,
and nobody seeing that message has a reason to connect it to a package.json
from three versions ago.

every plugin that exists today ignores node_modules, which is luck rather than
a rule — this makes it a checked one.

asked with `git check-ignore` rather than by reading .gitignore: the rule may
be nested, global, or in .git/info/exclude, and all three count.

warned, not fixed. writing into the plugin's own .gitignore would be the
platform editing a repository it does not own, and would itself dirty the
checkout — which is the exact thing being avoided.

src/servers/plugins/update.test.ts

@@ -3,6 +3,8 @@ import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { PLUGINS_DIR } from './discover';
 import { pullPlugin } from './update';
+import { discoverPlugins } from './discover';
+import { npmManifestFor, npmWouldBlockUpdates } from './npm-deps';
 
 // The REFUSALS are what this test is for. A pull that works is easy to believe; a pull that quietly
 // discarded somebody's uncommitted work is the failure that matters, and every plugin directory on a
@@ -53,3 +55,19 @@ describe('pullPlugin refuses rather than guesses', () => {
     }
   });
 });
+
+describe('npm packages and the Update button', () => {
+  // The trap: `pullPlugin` refuses on ANY uncommitted change, and `node_modules/` that nothing ignores
+  // is one. So a plugin shipping `package.json` without ignoring it installs perfectly once and can then
+  // never be updated — the button says "N uncommitted changes" forever, about a directory the platform
+  // itself created. Every plugin that exists today ignores it, which is luck rather than a rule.
+  test('atelier — the only plugin with packages — ignores node_modules', async () => {
+    const { plugins } = await discoverPlugins();
+    const withPackages = plugins.filter((p) => npmManifestFor(p));
+
+    // Not asserting that atelier specifically is installed — a checkout without it is legitimate.
+    for (const plugin of withPackages) {
+      expect(await npmWouldBlockUpdates(plugin), `${plugin.appName} would block its own updates`).toBe(false);
+    }
+  });
+});