feat(catalog): validate and publish GitHub plugin listings

[dviejokfs]

Summary

Introduce a GitHub-repository plugin catalog with minimal reviewed listings, immutable commit resolution, metadata generation, isolated compile checks, and a generated public registry/catalog.json. The first entry dogfoods gotempsh/temps-plugin-template.

Evidence

• bun test scripts/catalog.test.ts scripts/safe-extract.test.ts: 9 pass, 0 fail.
• bash scripts/validate-build.sh: Build checked gotempsh/temps-plugin-template@7506685 (install scripts disabled; compile network disabled). Six dependencies installed and native compile succeeded.
• CATALOG_BUILD_VERIFIED=1 bun scripts/catalog.ts --write: Validated 1 plugin listing(s). Snapshot now lists version 0.1.1 at the merged template commit.
• Template PR feat(deployment-pulse): add TypeScript reference plugin #1 is merged and contains live browser install/sidebar/API evidence.
• Security review approved the catalog workflows and bounded source extraction.

Merge order

Template PR #1 was merged first. This snapshot pins its merged commit 7506685388e6fbfa73e49ba4cc0293345965f99f. Merge this PR after its updated checks pass; then test discovery and installation through the Temps UI against GitHub main.

[dviejokfs]

Fixed the Linux runner permission failure in 0fbed77. Build containers now use the host UID/GID and HOME=/tmp; capability restrictions, ignored lifecycle scripts, and offline compilation are unchanged. Verification: 11 catalog tests pass; actual merged template Docker build passed at 7506685388e6fbfa73e49ba4cc0293345965f99f. Disposable Linux test reproduced Permission denied as UID1000 against UID1001-owned directory, then succeeded as UID1001. Security review approved this change. Waiting for current-head CI before merge.