feat(marketplace): add unified experimental extension catalogs - #60816

Issue for this PR

Closes #28696.

Ports #40108 to the current V2 runtime, following the maintainer's request when that PR was closed.

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Adds an experimental Marketplace for plugins, skills, agents, commands, MCP servers, instructions, and bundles.

• SQLite owns sources and installed state; Location config projects active packages without rewriting user JSONC.
• Install, update, and profile operations prepare a revision-bound, one-time plan. Apply verifies the materialized files before committing it.
• Supports local/HTTPS catalogs, SSH repositories, private GitLab catalogs, and compatible OpenAI, Copilot, and Claude plugin manifests. Credential values are resolved from environment bindings at request time.
• Adds app settings, /marketplace in the TUI, CLI workflows, and /api/experimental/marketplace with regenerated clients and OpenAPI.

The five commits are based on current upstream dev (1d479d7642).

How did you verify your code works?

• Pre-push bun run check: all 35 typecheck tasks passed; lint reported no errors.
• Core: 62 Marketplace/vanilla tests passed; database migration and config suites also passed. Core and Server passed typecheck:tsc.
• Server: 119 passed, 1 skipped, in an isolated environment. The new client-to-runtime test installs an agent, disables it, rejects plan replay, and preserves user JSONC byte-for-byte.
• Client API/alias tests: 43 passed; HTTP API codegen: 103 passed.
• TUI Marketplace/config tests: 15 passed. Built-app Playwright checks covered explicit installation approval and existing extension-row alignment.
• Real CLI smoke: add, list, install, profile export, lock export/verification, and uninstall passed against a private test server.
• Documentation typecheck, production build, and link validation passed.

Visual

<svg xmlns="http://www.w3.org/2000/svg" width="240" height="72" viewBox="0 0 240 72" fill="none">
  <style>
    @keyframes pulse { 0%,100% { opacity:.3 } 50% { opacity:1 } }
    .flow { animation:pulse 2.4s ease-in-out infinite }
    .done { animation:pulse 2.4s ease-in-out .8s infinite }
    @media (prefers-reduced-motion:reduce) { .flow,.done { animation:none } }
  </style>
  <g stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round">
    <rect x="9" y="15" width="47" height="42" rx="5" opacity=".55"/>
    <path d="M18 26h27M18 36h21M18 46h25" opacity=".7"/>
    <path class="flow" d="M64 36h29m-5-5 5 5-5 5"/>
    <path d="m104 24 20-10 20 10-20 11-20-11Zm0 0v25l20 10 20-10V24m-20 11v24" opacity=".8"/>
    <path class="flow" d="M152 36h29m-5-5 5 5-5 5"/>
    <rect x="190" y="15" width="40" height="42" rx="5" opacity=".55"/>
    <path d="M199 26h21M199 35h14" opacity=".55"/>
    <path class="done" d="m199 46 6 5 13-13"/>
  </g>
</svg>

Screenshots / recordings

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR