feat(plugins-registry): serve GET /bundles.json + /bundles-schema.json

[acamarata]

Summary

P6-E4-W3-S3-T8. Adds the two missing CF worker routes ADR-P6-03 specifies:

• GET /bundles.json — bundle-to-plugin membership map
• GET /bundles-schema.json — the schema it validates against

Both fetch from GitHub via the same authenticated Contents API pattern
fetchProRegistry already uses (reused, not reimplemented — see
fetchGitHubContentsJson in index.js / the mirrored helpers in
registry.ts), cached in PLUGINS_KV under their own keys
(bundles-json-v1, bundles-schema-v1) distinct from the existing
registry:* keys, and POST /api/sync now busts those two keys as well.

bundles.json is structurally validated against the 6 canonical bundle
slugs (task, chat, claw, family, sentry, clawde) before being served —
a fetch failure or a schema failure both return 502, never a malformed
200.

Implemented in both index.js (the file wrangler.toml actually deploys —
main = "src/index.js") and the parallel index.ts / registry.ts
module that this repo also typechecks in CI, kept functionally in sync.

Repo-rename note (important)

The plugins-pro → bundles rename (ADR-P6-01 / P6-E4-W3-S3-T6) has not
landed. nself-org/bundles does not exist yet. This PR therefore fetches
from nself-org/plugins-pro (current, live repo name) — not bundles —
so it works today. Once the rename lands, update the two URL constants:

• BUNDLES_JSON_API_URL / BUNDLES_SCHEMA_API_URL in
  .workers/plugins-registry/src/index.js
• the equivalent constants in .workers/plugins-registry/src/registry.ts

Nothing else in this route needs to change — the route handlers, KV keys,
validator, cache headers, and tests are all repo-name-agnostic.

Counts endpoint

The ticket's guide step for "counts" says GET /plugins already returns
live free / pro / total counts computed from the fetched registry
array lengths (handlePluginList) — confirmed by reading the source, this
requires zero code change. No separate /counts.json worker route was
added; I could not find any consumer (CLI, ping_api, web) that expects the
worker itself to serve counts — the CLI's nself plugin count reads a
vendored plugins/counts.json artifact directly from the plugins repo,
unrelated to this worker.

Test plan

• pnpm run typecheck (tsc --noEmit) — clean, 0 errors
• pnpm run test (node --test src/*.test.mjs) — 21/21 pass (9
  pre-existing + 12 new in bundles.test.mjs, covering
  validateBundlesJson structural checks and handleBundlesJson's
  KV-hit / fetch-failure / schema-failure / happy-path branches via a
  mocked globalThis.fetch, no real network call)
• wrangler dev --local — /health 200, /bundles.json gracefully
  502s with no GH_ACCESS_TOKEN set (never a malformed 200), the
  404 fallback's endpoint list includes both new routes
• wrangler deploy --dry-run --env production — clean build (36.97
  KiB / 8.80 KiB gzip), all production bindings resolve
• Sanity check: ran the real, current plugins-pro/bundles.json off
  disk through validateBundlesJson() — passes with 0 errors
• Live curl https://plugins.nself.org/bundles.json — not done,
  deploy is owner-gated (see below)

Not deployed. wrangler deploy was intentionally not run.