feat(market): restructure as the Mayfly/DSH plugin marketplace

[GeekCmore]

What

Turns this repository into the official plugin marketplace for Mayfly / DSH, per the agreed design. Two halves:

1. plugins/ — the eight plugin sources move here (pure git mv, plus three fixes needed to make GitHub installs work: lib/ build output committed for codex-terminal / sessions / mock, prepare/prepack lifecycle scripts removed since git installs use committed lib, see below).
2. registry/ — the marketplace: manifest schema v1, 8 official + 6 dsh listings, community submission flow.

Plus zero-dependency tooling (scripts/), CI (registry-validate, index-publish), the first generated dist/index.json + dist/catalog.json, and docs (docs/market.md, rewritten README, updated AGENTS.md).

Key design points

• Manifests are discovery/install metadata only — the runtime contract stays package + cordis.patch.yml; no runtime manifest (Mayfly's red line).
• Surfaces (server / web / tui) declare what a plugin contributes; usefulness in a frontend is derived (server ∨ own contribution).
• Two install sources: npm (preferred) and github: incl. monorepo subdirs (github:Ephemeral-AI-Lab/dsh-plugins#main&path:plugins/loop). All rows of an entry install together (this is also how sibling peers resolve — verified).
• Two activation modes: bundle (package self-declares dsh.bundle.patch) and profile-patch (installer inserts rows into the profile cordis.patch.yml — what the @deepseek-ai optional plugins need; none of their tarballs ship a patch).
• install.allowBuilds: pnpm ≥ 10 blocks dependency build scripts; codex-terminal (node-pty) and coding-plan (@google/genai, protobufjs) genuinely need them, so the manifest declares the allowance and the installer writes it into the profile workspace.
• Official plugins install from GitHub because the dsh-* npm names are currently unpublished — their lib/ output is committed for that reason (release checklist in AGENTS.md).
• Trust: official / dsh / community tiers, verified recorded at review (lightweight: track latest, weekly re-verification flags drift), removed tombstones instead of deletions.
• dist/ is workflow-owned: index-publish rebuilds and lands changes via auto-merged PR (never direct pushes to main), then can notify the mayfly website (MARKET_NOTIFY_TOKEN secret, optional).

Verification (all run locally against this branch)

• node scripts/validate-manifests.mjs — 14/14 pass
• node scripts/verify-packages.mjs --github-ref market/registry-v1 — all green, including real scratch installs into throwaway profiles:
  • 8 npm tarball checks (patch present or activation: profile-patch)
  • 9 GitHub installs (loop/mock/preset-builder/sessions/workbench-ui/sidechat×2 rows together/codex-terminal with node-pty build/coding-plan)
• node scripts/build-index.mjs — dist/index.json (50 KB) + catalog.json (76 KB) generated and jq-parseable

This scratch verification caught four real issues during development, now fixed: pnpm allowBuilds on lifecycle scripts, unpublished dsh-workbench-ui peer (solved by joint-row installs), scoped-name @ version misparsing, and the @scope YAML quoting in generated pnpm-workspace.yaml.

Follow-ups (separate PRs, mayfly repo)

• /plugin command consuming dist/index.json
• Website marketplace section (nav third tab + generated plugin pages)

🤖 Generated with Claude Code