ce6d9e62cd
- cmd_install: curated catalog resolution first, community-index fallback with unreviewed warning - _install_plugin_core: removed-blocklist gate on top of main pinned-metadata installer - cmd_update: catalog sidecar re-pins to catalog SHA (never git pull) - validator: config_schema (v2) shape check; portable Agent Plugins v1 plugin.json admission - admission CI: accept plugin.json-only packages at the pinned SHA - cmd_list: catalog:<tier>@<sha> provenance + removed annotations (table + JSON)