[ymote]

Mini apps now opens a built-in app catalog with the native Article editor, plus a separate import flow. Both standalone and OctoSense-hosted Rinx embed the same build-validated catalog.

Stacked on #27 (fix/standalone-octos-packaging) to preserve its tested deployment and SVG editor integration. Merge #27 first, then retarget this PR to main.

• Add ADR 0008, system-apps.json, canonical App Hub manifests under apps/, and a portable catalog packager used by build.rs.
• Move the native editor into apps/article-editor/native/, the loader/lifecycle into src/miniapps/, and Matrix/Octos adapters into src/host/. Preserve public Rust module paths, the editor app ID, stored data, share-message identity, and native consent/publication workflows.
• Admit embedded scripts through the existing review/run path and recheck their manifest and digest. Reject imported built-in IDs, traversal/symlinks, stale digests, unknown capabilities and unregistered native entries. Downloaded manifests cannot acquire native authority.
• Preserve host-owned Octos services and provider configuration. Standalone settings stay available; hosted mode hides them. No kernel or peer is created per mini app.

Validation on macOS: 208 native library tests passed (one existing test ignored), 7 portable packager tests passed, catalog packaging and the hosted feature build passed, and translation checks report no missing keys. The offline native Makepad harness passed catalog/import navigation, layout, editor launch and the signed-out authorization gate in both deployment modes. It does not log in to Matrix or start Octos.

The new catalog has not been installed or validated on OnePlus 6. The earlier editor integration's device results belong to #27; existing phone installations and OctoSense pins are unchanged here. External App Hub download/store UI is outside this change.