Extend datumctl with service-specific commands

[scotwells]

The problem

datumctl covers core platform operations, but service teams (DNS, networking, billing, audit) have no way to ship their own commands. Today those teams either wait on a core datumctl PR — slowing them down and expanding the core binary — or ask operators to install and authenticate a separate tool, breaking the "one CLI" experience.

What this enables

For service providers: Ship a datumctl-dns, datumctl-networking, or datumctl-billing binary independently. Operators get your commands under the datumctl umbrella (datumctl dns zones list) without you touching the core repo. Your plugin automatically inherits the operator's active org, project, and authenticated session — no separate login required.

For operators: Install service extensions with a single command (datumctl plugin install datumctl/dns). Installed plugins work exactly like built-in commands. A lock file lets you reproduce the same set of extensions across machines or in CI.

Success looks like

A DNS team ships datumctl-dns and operators run datumctl dns zones list with no extra setup. Removing the plugin restores the original experience cleanly.