fix(dev-host): reload manifest.json instead of failing the identity check

The dev host read manifest.json once at startup and froze that copy in
the Sidecar, while the backend watcher happily rebuilt the binary on any
source edit. Editing the manifest while the host ran — a routine version
bump during a release, for example — then made every restart compare the
fresh binary against the stale in-memory manifest and fail with "Sidecar
identity or protocol does not match manifest" until the whole dev host
was restarted.

Two layers of fixing: the project root now watches manifest.json and hot
swaps the in-memory copy (plus secret-key collection), and the sidecar
handshake re-reads the manifest from disk before declaring a mismatch, so
the check can no longer race the watcher. A genuinely disagreeing
manifest still fails the handshake.

plugins/sdk/dev-host/ui/App.vue

@@ -454,7 +454,19 @@ onBeforeUnmount(() => {
           </div>
         </div>
         <div class="relative min-h-0 flex-1">
-          <iframe v-for="f in frames" v-show="active === f.id" :key="f.id" :ref="(el) => (el ? windows.set(f.id, el) : windows.delete(f.id))" :srcdoc="f.html" sandbox="allow-scripts" allow="clipboard-write" referrerpolicy="no-referrer" :title="frameName(f)" class="absolute inset-0" @load="init(f)" />
+          <iframe
+            v-for="f in frames"
+            v-show="active === f.id"
+            :key="f.id"
+            :ref="(el) => (el ? windows.set(f.id, el) : windows.delete(f.id))"
+            :srcdoc="f.html"
+            sandbox="allow-scripts"
+            allow="clipboard-write"
+            referrerpolicy="no-referrer"
+            :title="frameName(f)"
+            class="absolute inset-0"
+            @load="init(f)"
+          />
           <div v-if="!frames.length" class="grid h-full place-items-center text-sm text-base-content/50">
             <div class="flex items-center gap-2"><Settings2 :size="18" />{{ t("尚未打开工作台") }}</div>
           </div>