docs: sync Base MCP plugin safety rules

[JasonColapietro]

Summary

• sync the docs-hosted Base MCP skill with the canonical name-gated plugin routing rule
• make clear that plugins are third-party services Base does not operate, endorse, or audit
• align the mirrored plugin authoring spec with the same third-party terminology

Why

The quickstart points agents at this docs-hosted skill, but its routing guidance lagged behind base/skills. The stale copy could select a protocol from a capability-only request instead of asking the user to choose.

Verification

• npm test (80 passing)
• git diff --check

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1