## Summary

Addresses worker-side feedback from the Temporal team (DABH) on

[temporalio/sdk-python#1447](temporalio/sdk-python#1447).

**Plugin (`tenuo-python/tenuo/temporal_plugin.py`)**
- No longer mutates the user's `TenuoPluginConfig`; works on a shallow
copy so two workers sharing a config stay isolated.
- Registers Tenuo's domain exceptions (`TenuoContextError`,
`PopVerificationError`, `TemporalConstraintViolation`, `WarrantExpired`,
`ChainValidationError`, `KeyResolutionError`, `LocalActivityError`) as
`workflow_failure_exception_types` on SDKs that support it.
- Preload failures log at `ERROR` with the resolver class name;
`EnvKeyResolver` preload failure raises `ConfigurationError` (no safe
`os.environ` fallback in the sandbox).
- `ensure_tenuo_workflow_runner` emits a `UserWarning` plus a logger
warning when given `UnsandboxedWorkflowRunner` (Tenuo still works — the
user is just opting out of Temporal's own determinism guardrails, which
is a legitimate choice for debugging), and warns for unknown custom
runners.
- Duplicate-registration error now points at
`Client.connect(plugins=[plugin])` inheritance instead of advising
one-plugin-per-worker.

**Plugin-confusion rename (`tenuo.temporal.TenuoPlugin` →
`TenuoWorkerInterceptor`)**
- The old name was a Temporal SDK `WorkerInterceptor`, not a Temporal
SDK `Plugin`, and its resemblance to
`tenuo.temporal_plugin.TenuoTemporalPlugin` caused real
misconfigurations (e.g. `Worker(plugins=[TenuoPlugin(...)])` silently
accepting an unusable argument).
- New canonical name: `tenuo.temporal.TenuoWorkerInterceptor`.
- Backward compat: `tenuo.temporal.TenuoPlugin` is still importable as a
deprecated alias and emits a `DeprecationWarning` on first resolution;
scheduled for removal in a future beta. Most users register
`TenuoTemporalPlugin` via `Client.connect(plugins=[plugin])` and are
unaffected.
- Updated all internal usages, tests, examples (5 files), and docs.
Added an "About the names" callout table in `docs/temporal.md` and a
"renamed from" breadcrumb in `docs/temporal-reference.md`.
- New unit test asserts the alias warns and resolves to the new class.

**Tests**
- `DictKeyResolver` raises `KeyResolutionError` instead of `ValueError`.
- 7 new unit tests in `tests/adapters/test_temporal_plugin.py` cover
every plugin-side change above, plus the deprecation-alias test.

**Deferred to follow-ups**
- Making `ensure_tenuo_workflow_runner` private — useful public escape
hatch for advanced users; keep public.
- Replay-time negative tests (tampered history, rotated trusted roots,
clock-boundary). Initial attempts revealed that the current plugin
architecture does not re-verify activity PoP during replay — activities
don't re-execute, and the workflow inbound interceptor only stashes
headers without re-checking. Designing meaningful replay-safety tests
requires plumbing changes and should be scoped as its own task.

## Test plan
- [x] `uv run pytest tests/adapters/test_temporal_plugin.py` — 33 passed
(incl. new deprecation test).
- [x] `uv run pytest tests/adapters/test_temporal.py
tests/adapters/test_transparent_interceptor.py
tests/adapters/test_temporal_integration.py
tests/e2e/test_temporal_replay.py` — 166 passed.
- [x] `uv run pytest tests/e2e/test_temporal_e2e.py
tests/e2e/test_temporal_replay.py` — 61 passed.
- [x] `uv run pytest tests/security/test_security_contracts.py
tests/security/test_integration_invariants.py` — 117 passed, 22 skipped.
- [x] `uvx ruff check` clean on modified files.
- [x] `mypy tenuo/temporal/__init__.py tenuo/temporal/_interceptors.py
tenuo/temporal_plugin.py` — no errors.
- [x] All 5 Temporal examples byte-compile.