fix(zsh): align canonical entrypoint guidance

[ss-o]

Summary

• align scoped Zsh guidance with call-site source resolution
• update the new-plugin template to pass source identity as argument 1
• enforce the invocation and read-only path boundary in policy tests

Verification

• python3 -m unittest scripts/test_validate_zsh_standard_policy.py -v (99 tests)

Parent: #567

Closes #568