feat(catalog): support plugin subdirectories and custom git refs

[dviejokfs]

Allow catalog entries to select a self-contained plugin directory and a branch, tag, or commit. For example, two entries can share example/plugins while selecting different path values. Metadata, README, and asset URLs resolve within each selected directory at one immutable commit.

The build plan now binds repository, path, ref, and commit. Build validation extracts only the selected subtree and continues disabling lifecycle scripts and compile-time network access. PR and refresh builds use the same validation script. Catalogs containing subdirectory entries use schema version 2 so older hosts reject them rather than silently selecting the root.

Evidence

• bun test scripts: 33 passed, 0 failed. Covers slash-containing custom refs, missing refs without default fallback, sibling entries, duplicate source paths, traversal, symlinks, and scoped extraction.
• bash -n scripts/validate-build.sh: passed.
• Native fixture: extracted plugins/demo from an archive containing an invalid root manifest; ran locked dependency installation and bun build --compile src/index.ts; resulting executable returned {"plugin":"nested-fixture","ok":true}.
• Independent security and registry review: passed.

Compatibility and limits

Companion Temps host PR: gotempsh/temps#1045. Requires that support for schema v2 and the install path field. Root-only catalogs retain schema v1. Existing installs are not automatically updated. Subdirectories need their own lockfile and complete build assets; parent workspace dependencies are not included. Archive limits still apply to the entire repository. The live GitHub catalog refresh/build pipeline has not been run for a newly listed nested plugin; no listing is added here.

Native plugins execute with the host OS account's permissions; this feature does not add runtime sandboxing.