v3.0.0 — Trusted Remote Catalog + Governance Layer

• Corrected the registry/governance release into v3.0.0 after v2.9.1 carried the new feature set.
• Added trusted registry governance foundation.
• Added registry commands for status, list, sync, verify, and policy-aware source handling.
• Added local registry source model and registry cache structure.
• Added registry policy engine for approval gates, allowed write roots, blocked paths, and remote safety controls.
• Added checksum/provenance foundation for trusted catalog sources.
• Added bundled/local/remote catalog source priority model.
• Added dashboard registry visibility in read-only/headless-safe form.
• Added documentation for registry sync, trusted registries, registry policy, registry security, and remote catalog authoring.
• Expanded verification to cover registry commands and offline safety behavior.
• Kept remote discovery opt-in only.
• Kept catalog/plugin system declarative only.
• No arbitrary code execution.
• No package installs from registries/plugins.
• No network dependency in CI verification.
• Kept npm publishing manual and protected by prepublish guard.