Honor managed plugin disablement for executor capabilities (#40640)

## Why

Selected executor plugin roots could still expose capabilities when managed
requirements disabled the `plugins` feature.

## What changed

- Suppress MCP servers, skills, apps, and connectors from selected executor
  plugins when `plugins` is disabled, while preserving the selected-root
  identity used to filter those capabilities.
- Apply the policy consistently to direct selected-root discovery and batched
  executor capability discovery.

## Testing

- Add contributor-level and app-server coverage that verifies disabled plugin
  capabilities are absent and their MCP servers never start.

GitOrigin-RevId: e30bd8a936c4b0e083908b89a65f4d02e01747de