feat(addons): unified distribution Phase 1 — kind taxonomy + managed addon binaries

[yvgude]

Summary

Phase 1 of the unified-distribution epic #724 (closes #725). Design doc ships in this PR: docs/specs/unified-distribution-v1.md.

• kind package taxonomy — PackageManifest gains kind: context | skills | addon | grammar. Default context is omitted when serializing (byte-compat: every existing .ctxpkg unchanged); non-context kinds require schema v2, enforced in validate(). Spec §3.4 + JSON schema updated.
• Unified artifact installer — new core/addons/artifact_install.rs: the single download → SHA-256 verify → harden → atomic-rename path. grammar_install (feat: grammar tiering — long-tail tree-sitter grammars as signed runtime addons #690) now delegates here with byte-identical behavior and unchanged policy gates; GrammarAsset is an alias of the shared ArtifactAsset.
• Managed addon binaries — [artifacts.<target-triple>] in lean-ctx-addon.toml: addon add fetches the platform binary into <data_dir>/addons/bin/<name>/<version>/ (never PATH), auto-pins the hash as spawn-time binhash, rewrites the gateway command to the absolute managed path, records an ArtifactReceipt. addons.policy = locked blocks the fetch before any network I/O. Resolution order: artifacts → [install] bootstrap → PATH.
• addon update <name> — side-by-side version dirs, health-gated flip, prune after success; a failed update leaves the working install wired. addon remove deletes managed binaries.
• Doctor — verifies every artifact receipt: binary exists + hash matches + not revoked.

Acceptance criteria (from #725)

• Addon with artifacts: zero PATH interaction (managed dir + absolute-path spawn)
• Tampered managed binary ⇒ refetch attempted, never silently accepted (spawn stays binhash-gated)
• locked policy ⇒ no network fetch (unit test)
• Grammar behavior byte-identical after the module move (same messages, same gates, tests unchanged)
• Existing packs round-trip byte-identically (default_kind_is_omitted_from_serialization)
• Determinism guarantees untouched (fix(ctx_expand): fall back to reference_store for ref_-prefixed IDs #498) — no timestamps/counters in any new output

Test plan

• 7320 lib tests pass (12 new: kind round-trip/validation, artifact parsing/validation, installer short-circuit/locked/tamper, receipt persistence, prune/remove)
• cargo clippy --all-features -- -D warnings clean
• Preflight (fmt, clippy, rustdoc, gen_docs drift, Windows cross-compile) green
• E2E with a real released artifact follows with the lean-md reference case (Unified Distribution Phase 3: kind=skills + cross-kind dependency resolution (lean-md reference case) #727 / dasTholo's PR feat: integrate lean-md as an external lean-ctx addon (+ LSP formatter routing) #721)

Made with Cursor