feat(store): plugin store host module — signed catalogs, tiered trust, install jobs

The index is the verification gate: a catalog entry pins one exact version
plus that version's tarball integrity hash, so 'verified on every release'
is a property of the data rather than a promise about process. Nothing can
express 'track latest' for a catalogued plugin.

- store/index.rs   signed index parse + ed25519 verify (ring), validate-and-drop
                   per entry, semver minHost/advisory ranges
- store/sources.rs built-in unom source (compiled-in URL + two key slots for
                   rotation) + operator sources in plugin-sources.json
- store/catalog.rs https fetch with size/timeout/redirect caps, signature before
                   parse, last-good disk cache (stale-but-usable when offline)
- store/jobs.rs    single-flight install/uninstall: registry-integrity preflight
                   against the pin, spawn the runner CLI with live log capture,
                   post-install version check with rollback, provenance record,
                   runner restart (discovery is startup-only)
- store/manifest.rs install provenance; absence means CLI-installed
- mgmt/store.rs    12 routes under /api/v1/store, denied to the plugin token
                   (a plugin that can install plugins is an escalation primitive)

Also generalizes runner discovery and listInstalled from @punktfunk/plugin-*
to ANY scope's plugin-*: catalog entries must be scoped so the scope can map
to that entry's registry, so a third-party plugin necessarily arrives under
its own scope and would otherwise install but never run.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/events.rs

@@ -170,6 +170,12 @@ pub enum EventKind {
         /// lease-expired). A consumer re-reads `GET /api/v1/plugins` for the new set.
         id: String,
     },
+    #[serde(rename = "store.changed")]
+    /// The set of installed plugins, or what the store knows about them, changed — an install or
+    /// uninstall finished, or a catalog refresh brought in new rows. A consumer re-reads
+    /// `GET /api/v1/store/catalog` / `…/installed`. Deliberately payload-free: the store's answer
+    /// is a join over several sources of truth, so "go look again" is the only honest signal.
+    StoreChanged,
     #[serde(rename = "host.started")]
     HostStarted {
         version: String,
@@ -197,6 +203,7 @@ impl EventKind {
             EventKind::DisplayReleased { .. } => "display.released",
             EventKind::LibraryChanged { .. } => "library.changed",
             EventKind::PluginsChanged { .. } => "plugins.changed",
+            EventKind::StoreChanged => "store.changed",
             EventKind::HostStarted { .. } => "host.started",
             EventKind::HostStopping => "host.stopping",
         }