fix(plugins): close subscription gaps found in review

- Losing daemon.manage now releases the session's plugin subscriptions;
  binary events bypass the outbound permission check, so streams would
  otherwise outlive the revocation.
- A subscribe that times out sends unsubscribe, since the plugin may
  still start the handler after the daemon gave up.
- The byte limit leaves room for the largest frame header and routing,
  and lives in assertPluginWireValue so events, outputs and inputs share it.
- A release right after the host accepted keeps `ready` resolved, so a
  handler that returns at once reports closed rather than an error.
- Session trace logging tolerates loggers without isLevelEnabled.

public-docs/plugins/reference.md

@@ -2333,10 +2333,10 @@ union and branch with `event instanceof Uint8Array`. A `Uint8Array` nested in an
 validation on the sending side with an error that names the rule; send the bytes as their own
 event or RPC value and the metadata as a separate JSON event.
 
-One event or RPC value carries at most 100 MiB. Push large payloads in chunks of a few hundred
-KiB; each `push` waits for the previous one to leave the plugin process. Uploads from a phone have
-a lower limit: Android closes the connection when one send exceeds 16 MiB, so split a larger
-upload into several RPCs.
+One event or RPC value carries at most 100 MiB less 65 KiB of framing. Push large payloads in
+chunks of a few hundred KiB; each `push` waits for the previous one to leave the plugin process.
+Uploads from a phone have a lower limit: Android closes the connection when one send exceeds
+16 MiB, so split a larger upload into several RPCs.
 
 ### Several streams on one subscription
 

public-docs/plugins/reference.zh-CN.md

@@ -2016,7 +2016,7 @@ const png = await renderThumbnail({ path, width }); // Uint8Array
 
 用 `z.instanceof(Uint8Array)` 声明字节。事件可以在每次推送时选择字节或 JSON：声明一个联合类型，并用 `event instanceof Uint8Array` 分支。嵌套在对象中的 `Uint8Array` 会在发送端校验失败，错误信息会说明这条规则；把字节作为单独的事件或 RPC 值发送，元数据作为另一个 JSON 事件发送。
 
-一个事件或 RPC 值最多 100 MiB。大载荷请按几百 KiB 分块推送；每次 `push` 都会等待上一次离开插件进程。手机上传的上限更低：一次发送超过 16 MiB 时 Android 会关闭连接，所以较大的上传请拆成多个 RPC。
+一个事件或 RPC 值最多 100 MiB（减去 65 KiB 的帧头）。大载荷请按几百 KiB 分块推送；每次 `push` 都会等待上一次离开插件进程。手机上传的上限更低：一次发送超过 16 MiB 时 Android 会关闭连接，所以较大的上传请拆成多个 RPC。
 
 ### 在一个订阅中传输多条流 {#several-streams-on-one-subscription}