phase2-onboarding: adopt Phase 0 contract for m-cli-extras

[rafael5]

Summary

Onboards m-cli-extras as a Tier-2 entry to the org-level AI-discoverability catalog. Pattern mirrors m-modern-corpus (generator-based exposed payload) and m-test-engine (authored-from-scratch AGENTS.md + tools/check-manifest.py drift gate).

• AGENTS.md (+ CLAUDE.md symlink) — YAML frontmatter descriptor (kind: [tool, plugin-host], exposes.plugins, companions.m-cli = consumer-of-this-plugin-group) plus the five required Phase-0 sections (Setup / Test / Build / Verify / Guardrails). Calls out the not-a-CLI semantics, the don't-hand-edit-dist/plugins.json rule, the new-plugin-as-its-own-subdir convention, and m-stdlib's architectural priority over m-cli-extras.
• tools/gen-plugins.py — stdlib-only deterministic generator (tomllib). Reads [project.entry-points."m_cli.plugins"] from pyproject.toml and emits dist/plugins.json with schema_version="1", sorted by plugin name, 2-space indent, trailing newline. Byte-identical on re-run (md5 verified).
• tools/check-manifest.py — copied verbatim from tree-sitter-m. Validates dist/repo.meta.json shape + that every exposes.* path resolves on disk.
• dist/plugins.json — today's emission, listing the one shipped plugin (corpus-stats → m_cli_extras.corpus_stats.cli:register).
• dist/repo.meta.json — id: tool:m-cli-extras, role = out-of-tree m-cli plugins, exposes: plugins + pyproject_toml, consumes: [tool:m-cli], verification_commands: [make manifest, make check-manifest, make test], verified_on: 2026-05-10.
• Makefile — three new .PHONY targets added (manifest, check-manifest, check-docs-prose). Existing dev targets untouched.
• .github/workflows/ci.yml — two engine-free steps (make check-manifest, make check-docs-prose) inserted before the sibling-clone / uv sync / test steps, so a broken manifest fails fast without paying the install cost.
• .gitignore — dist/ → dist/* with !dist/repo.meta.json and !dist/plugins.json exceptions. Same fix tree-sitter-m's onboarding needed in commit ade59d6 — without this, Python's default dist/ ignore silently drops the Phase-0 contract artifacts.

Local verification (all green)

$ make manifest                  # twice — byte-identical (md5 match)
$ make check-manifest            # → 0
$ make check-docs-prose          # → no docs/ ✓
$ /home/rafael/m-dev-tools/m-standard/.venv/bin/python \
    /home/rafael/m-dev-tools/.github/profile/build/validate-repo-meta.py \
    dist/repo.meta.json
OK: dist/repo.meta.json

Plugins enumerated

{
  "plugins": [
    {
      "module": "m_cli_extras.corpus_stats.cli:register",
      "name": "corpus-stats",
      "registered_by": "m_cli.plugins"
    }
  ],
  "schema_version": "1"
}

Out of scope (deliberate)

• No changes to m-dev-tools/.github. Org-side catalog refresh is a separate coordinated follow-up.
• No new runtime deps. tools/gen-plugins.py is stdlib-only (tomllib, Python 3.11+).

Test plan

• make manifest twice produces byte-identical dist/plugins.json
• make check-manifest exits 0 locally
• make check-docs-prose exits 0 locally
• Canonical Track-A validator returns OK: dist/repo.meta.json
• CI: manifest drift gate passes
• CI: docs-prose gate passes
• CI: existing lint / mypy / pytest pipeline still green