PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing (CVE-2026-47781) | HOL Guard CVE