Handle plugin entrypoint load failures gracefully

[tgies]

Summary

• Fixes Handle plugins that crash during load #1280 — a single broken plugin (e.g., llm-gpt4all under Rosetta) crashes load_plugins() entirely, making llm unusable.
• Replaces pm.load_setuptools_entrypoints("llm") with a custom _load_entrypoint_plugins() that catches per-plugin exceptions, prints a warning to stderr, and continues loading remaining plugins.
• Handles partial registration rollback if register() fails mid-way.
• Adds LLM_STRICT_PLUGIN_LOADING environment variable to opt into hard failures for plugin development.

Test plan

• test_load_entrypoint_plugins_continues_on_failure — broken plugin doesn't block others
• test_load_entrypoint_plugins_cleans_up_partial_registration — rollback on mid-registration failure
• test_load_entrypoint_plugins_skips_already_registered — no double-load
• test_load_entrypoint_plugins_skips_blocked — respects blocked plugins
• test_load_entrypoint_plugins_strict_mode — LLM_STRICT_PLUGIN_LOADING=1 raises
• Manual: install a broken plugin, confirm llm still works with a stderr warning