how are you meant to include 3rd party pip deps in plugins? do I need to use a subsystem?

I think you can make it work by adding them to

[GLOBAL].plugins

as a "cheat"

You can also create a venv pex and run a subprocess with that dep available. See, for example, the Terraform plugin’s dependency inference rules: https://github.com/pantsbuild/pants/blob/main/src/python/pants/backend/terraform/dependency_inference.py

hm. grim. It's a one-file dependency, so I think I'm just gonna copy/paste.

thirdparty dependencies are definitely supported: see https://www.pantsbuild.org/v2.12/docs/plugins-overview#in-repo-plugins