4eb4bcfc50
writeMod hand-reconstructs plugin.mod field by field but never emitted three first-class core.ModFile fields, so ParseModFull → mutate → writeMod (every bump/init/tags edit) silently stripped them. For allowed_hosts this is security-relevant: a `ninja plugin bump` erased a plugin's ADR-0023 egress declaration, the install/update consent gate saw nothing to grant, and the plugin's outbound calls were denied at runtime with no prompt ever shown. Emit all three; add a writeMod ⇄ ParseModFull round-trip regression test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>