refactor(build): centralize plugin surface metadata

[sent-dm]

What changed

• Added scripts/repository_metadata.py as the shared loader for canonical version, discovered skills, tool ownership, mutation class, and confirmation policy.
• Added packages/sent/public-surface.json as the explicit MCP allowlist and generated it into every adapter surface.
• Derived validator and generator behavior from canonical metadata instead of hardcoded version, skill-count, and tool-count constants.
• Validated skill/eval/tool ownership, OpenAI annotation consistency, confirmation rules, commands, and generated trees against the same metadata.
• Added temporary-source version propagation coverage across root, Codex, Claude, and marketplace manifests.
• Removed low-value skill/tool counts from marketing descriptions.
• Added rejection gates for unexpected tools, invalid owners, and mutation annotation drift.

Why

Version, skill, and MCP surface facts were duplicated across Python constants and marketing copy. A new skill or release could require unrelated count edits and still drift from submission metadata.

Validation

• python3 scripts/generate_adapters.py --check
• python3 scripts/validate.py
• python3 scripts/test_fixtures.py
• python3 scripts/test_contracts.py
• python3 scripts/test_validation_gates.py
• git diff --check

Stacked on #7.