feat: publish official marketplace registry v2

[superche]

Summary

• turn convax-plugins into the Official Marketplace with a versioned descriptor, Registry v2, strict v1 projection, Showcase output, and deterministic immutable artifacts
• move canvas-storyboard into its sole source repository and publish it as the Builtin standalone Skill
• declare the darwin-arm64 ffmpeg-tools preinstall and exact product-lock inputs
• add reviewed HTTP and managed-stdio MCP Server fixtures plus third-party marketplace scaffold coverage
• replace the legacy publish workflow with default-branch version-change release selection and immutable release verification
• extend JianYing import metadata and companion contracts for the host-managed toolbar path

Why

The Convax host now consumes all Plugin, Skill, and MCP capabilities through one Marketplace source graph. This repository must therefore own the Official catalog, deterministic release closure, product-lock inputs, and concrete Builtin/Official source bytes without duplicating them in Convax.

Paired host PR

• microvoid/convax#61

The host PR owns the public authoring packages. The verified @convax/marketplace@0.1.0 and @convax/marketplace-kit@0.1.0 tarballs are now published to the official npm registry, and this repository locks the exact public Kit without a local link or machine path.

Validation

• bun install --frozen-lockfile --ignore-scripts
• npm registry @convax/marketplace-kit@0.1.0
• bun check
  • build for Plugin and Skill workspaces
  • Registry validation for 28 packages at sequence 44
  • typecheck in 7 workspaces
  • all workspace tests
  • 6 verified companion targets, including source-built FFmpeg 8.1.2
  • convax-marketplace check .
  • 148/148 tooling tests
  • deterministic Marketplace bundle/index/product-lock build
  • 28 v1 identities, 29 immutable Releases, and 65 exact assets
  • 1 Builtin reservation, 1 preinstalled package, and 7 immutable product-lock artifacts

Merge order

1. merge the published Convax authoring-package source from microvoid/convax#61
2. merge this PR so the default-branch release workflow publishes the Official artifacts