Function resolve_setup_script 

pub fn resolve_setup_script(
    manifest: &PluginManifest,
    plugin_dir: &Path,
) -> Result<Option<PathBuf>, SetupError>

Resolve the manifest-declared setup script to an absolute path inside plugin_dir, or return Ok(None) if no setup is declared.

Returns Err(EscapesPluginDir) if the declared path is absolute or contains .., or if the canonicalized path lives outside plugin_dir. Returns Err(NotFound) if the resolved path doesn’t exist on disk.

This is the security gate — the async runner trusts the path it gets from this function.