Trusted path for service-backed widgets on replacement bars (follow-up to #9618)

[felixzsh]

Follow-up to #9618 (which intentionally removed the generic facade factory from
replacement bars).

Impact: a third-party kind: bar plugin can only give the widgets it hosts a
service-less facade, so bar.shell.serviceFor("<id>") returns null. Service-backed
widgets then render empty on the bar while their panels still work. This hits
replacement bars that render the same registered widgets as the built-in bar — for
example my plugin felixzsh.widget-islands,
where widgets such as YouTube Music, media and live counters are blank on the bar.

Cause: pluginShellForBarEntry() in shell/shell.qml has no _serviceLookup, and a
third-party bar's shell does not expose pluginShellForId, so Bar.qml's
pluginBarApiFor() always falls back to that service-less entry facade.

Introduced by #9618:

• 1702cf0 Restrict third-party shell plugin capabilities
• 094c913 Tighten replacement bar plugin boundaries
• 572a34d Refresh cached plugin bar shell facades

Question: is a trusted/validated path planned for this — e.g. a per-widget service
facade scoped to the widget's own service, or a way to mark widgets/replacement bars
as trusted — so replacement bars like mine can host service-backed widgets? If not,
what is the recommended pattern for a replacement bar that must render the same
widgets as the built-in bar?