feat: require protected Host capability receipts

[fearclear]

Summary:

• add append-only Host capability policy v2 and protected human-decision receipt workflow
• bind approvals to exact accepted Plugin API ids and contract digests, strict runtime conformance, npm bytes, Host commit, immutable Release, and builder attestation
• update authoring docs and Skill so Plugins must submit Host requests and cannot edit Host implementation or generated Catalogs

Safety:

• receipt consumers reject empty or legacy Catalogs, missing APIs, changed contract digests, forged conformance, bot or self approval, and mutable evidence
• Multi Angle, Panorama Viewer, and Relight Studio remain publication-blocked until real external evidence exists
• no target Plugin source was changed

Verification:

• 119 tooling tests on top of latest main
• repository validation with five expected fail-closed blockers
• generated Skill API reference check
• workflow YAML parsing and diff check

Rollout:

• current vendored Catalog remains wire-schema/2 and SDK provenance is not yet published, so this PR intentionally does not remove the three blockers.

[fearclear]

Governance follow-up pushed in 869af1e.

• Replaces unavailable private-repository GitHub artifact attestations for Host API/SDK assets with OIDC keyless Cosign bundles and Public Rekor verification.
• Pins release workflow, source SHA/ref/trigger, GitHub-hosted runner, repository id 1293264965, owner id 125447777, Cosign v3.0.6, and the verifier byte digest.
• Keeps immutable GitHub Release verification and npm byte/SRI equality as separate gates; public convax-plugins decision attestations remain unchanged.

Verification:

• bun test tooling/host-sigstore-bundle.test.js tooling/plugin-authoring-governance.test.js tooling/plugin-publication-policy.test.js (21 pass)
• bun tooling/plugin-publication-policy.mjs --workspace .
• bun run check reached the sole sandbox-only codex-mcp port binding tests; rerunning bun test packages/tools/codex-mcp/test/llm-gateway.test.ts outside the restricted sandbox passed 3/3.
• git diff --cached --check

[fearclear]

Follow-up ab91909 removes the old one-request-per-package-version assumption. One exact package version may now carry up to 16 independently governed Host capability requests; blockers retain request identity, sort deterministically, and one receipt cannot resolve a sibling request.

This keeps image-session authority and generation-input binding as separate review decisions for Multi Angle/Relight rather than merging unrelated capabilities to satisfy tooling.

Verification: 44 focused governance/history/release tests passed (plus the agent full tooling run 146/146), protected publication policy passed, and diff check passed.