Registry publishing pipeline: automated scanner + capability-diff gate

[tayebmokni]

Summary

Implement the publishing pipeline / static scanner that gates plugin releases at the official registry. The new-capability gate is critical: a v1.4 plugin that suddenly requests db.write: core.users:* triggers manual review; reusing existing caps does not.

Scope: this issue covers ONLY the automated scanner + capability-diff job. Full registry UI + manual review queue UI is deferred to a later issue.

Doc §15.6 open question: at scale (10k+ plugins), what automated scanners do we trust to replace human review on common diffs?

Design reference

• docs/02-plugin-system.md §10.3, §15.6

Acceptance criteria

• Pipeline job triggered on every plugin upload to the registry
• Step 1: sigstore signature verification (re-uses Plugin signing: sigstore verification + identity match + air-gapped cosign fallback #233)
• Step 2: bundle scan — banned imports list (WASI fs-write, raw network sockets, OS escapes), oversized blobs, suspicious patterns (entropy on web/*.js to flag obfuscated code)
• Step 3: capability diff vs prior published version of the same slug; output structured diff {added: [...], removed: [...], scope_changes: [...]}
• Step 4: if added is non-empty OR scope_changes widens scope OR author changed: gate the release in pending_review state until a human approves
• If all checks pass with no new caps: auto-publish to released state
• Yanking: publisher or registry operator can yank a release (sets plugin_versions.yanked = true)
• needs-design: scanner thresholds (entropy, blob sizes, banned import list) — propose in docs/proposals/plugin-registry-scanner-policy.md
• Tests: cap-diff produces correct added/removed/scope-changes; banned import triggers gate; new author triggers gate; no-cap-change auto-publishes

Dependencies

#34 (manifest), #233 (signing), #249 (marketplace schema)

Complexity

L

[tayebmokni]

Closing — shipped in the merged Wave N PR. (GitHub's auto-close only matched the first 'Closes #N' keyword in the PR body; this issue was listed in the same PR but missed the syntax.)