feat(addons): unified distribution Phase 2 — addon publish, hosted installs, registry snapshots

[yvgude]

Summary

Implements the client side of Phase 2 of the Unified Distribution plan (#724, #726) — self-service addon publishing plus hosted installs, on the same package format, registry and trust chain as every other pack. Design: docs/specs/unified-distribution-v1.md.

• lean-ctx addon publish --namespace <ns> (core/addons/publish.rs): wraps the authoring lean-ctx-addon.toml verbatim into a signed kind=addon .ctxpkg and uploads it via the existing remote.rs publish path. Local gates run before any network I/O and mirror the hosted listing bar: schema validation, runnable [mcp] endpoint, non-empty description, and the audit.rs verdict — blocking findings (shell-exec, fetch-exec, non-HTTPS, malware heuristics, under-declared capabilities) refuse; review publishes with findings disclosed. --check runs everything including signing + a self-verification round-trip, then stops.
• lean-ctx addon add <ns>/<name>[@version]: resolves hosted packs — registry-index-verified download, integrity hashes, mandatory ed25519 signature (executable references get no unsigned path), and kind ↔ payload coherence — then the embedded manifest walks the exact same consent → preflight → health-probe pipeline as local/curated installs. Install source is recorded as ctxpkg:@ns/name@version; addon update re-resolves from that source (latest non-yanked).
• Kind ↔ payload coherence (verify::validate_kind_coherence): a kind=addon pack must embed a parseable, valid, runnable addon manifest whose name/version match the pack; any other kind must not carry an addon payload. Enforced in verify_package_text, on import, and in the publish self-check. The context registry refuses kind=addon packs (wrong trust chain — the error points at addon add).
• Registry snapshots (core/addons/registry_snapshot.rs + gen_registry): rust/data/{addon,grammar}_registry.json are now generated, canonical snapshots — validated (same bar as addon registry validate), name-sorted, deterministic, timestamp-free (fix(ctx_expand): fall back to reference_store for ref_-prefixed IDs #498). Drift fails CI, preflight and a lib test; hand-editing ends.

Server side (ctxpkg.com kind filter on resolve/search/catalog, leanctx.com catalog view) is tracked in #726 and stays open after this merge.

Test plan

• 7339 lib tests green (13 new: publish gates/roundtrip/verbatim, kind coherence, import gate, snapshot canonicality)
• cargo clippy --all-features -- -D warnings clean, cargo fmt --check clean, cargo doc clean
• gen_docs --check + gen_registry --check green; Windows cross-check green
• E2E smoke: addon publish --check builds, signs and self-verifies a real pack from a scratch manifest

Made with Cursor