[ymote]

Connected-app catalog entries currently include host_method in their tool summaries. Older stores reject that unknown field and cannot read the whole catalog. Project only the catalog display copy without this dispatch field; permission/risk metadata stays present, while admission, installed bundle bytes, publisher signatures and runtime tool routing remain authoritative.

The derived privacy summary now distinguishes direct network access from Google/GitHub/model traffic through host services, and names the connected-provider operations. English/Chinese publishing documentation also correctly identifies index entries as a maintainer export after hub publish.

This branch integrates the connected-services changes from #119 with current main's #118/#120, preserving both histories. The merge resolves the overlapping README and contract changelog by retaining both feature sets. No official catalog or publisher package is changed.

Validation:

• Focused Hub/policy/compatibility checks: 32 passed. New regressions reproduce the strict legacy parse failure, preserve canonical signature bytes after projection, install the original signed bundle with its real dispatch binding, and reject modified/forbidden bindings.
• Published app-contract API: cargo-semver-checks 1.2.0 → 1.5.0 passed all 202 applicable checks (58 skipped); no semver update required.
• Release hub build passed.
• Full cargo test --locked -p octosense-app-contract -p octosense-app-policy -p octosense-app-hub: 207 tests passed, including doc tests. No failures.

The legacy regression verifies the old wire shape and signing roundtrip; it does not claim execution of an old desktop binary or live provider acceptance.