Fix(plugin): add discriminant for pluginContext/contractAddress union

tokenContext_t contains an anonymous union where pluginContext[1024]
aliases contractAddress[20]+methodSelector[4] at offset 0. Nothing
prevented code from reading contractAddress after INIT_CONTRACT had
overwritten those bytes with plugin-private data.

Add a plugin_ctx_mode_t enum (PLUGIN_CTX_ADDR_SEL / PLUGIN_CTX_PLUGIN)
that tracks which half of the union is active. The discriminant is set to
PLUGIN_CTX_PLUGIN just before eth_plugin_call(INIT_CONTRACT) activates
the plugin context. An early app_exit() in eth_plugin_perform_init_default()
fires if the flag is already set, catching double-INIT_CONTRACT attempts
that would read stale plugin bytes as an address/selector.

(cherry picked from commit aa00b9a9fb93e5bad76c284ec559ed654d40aa84)