Function prepare_content_install 

pub fn prepare_content_install(
    manifest_json: &str,
    registry: &PluginRegistry,
) -> Result<Manifest, String>

Validate an incoming content-plugin manifest end to end and return it ready to merge. Runs, in order: JSON parse, schema validation, the content-only gate, signature verification, and the not-already-installed check. Detector/export plugins validate but are rejected here — they need the wasm runtime that a later slice adds.

Signature note: a content plugin ships no wasm module, so the signature is verified over the manifest alone (no module hash).