feat: add exact public plugin fixture matrix

[builtbyhuy]

Summary

• add a fixed 10-repository by 2-Codex-version compatibility matrix
• bind immutable tree hashes, marketplace source, plugin subtree/version, and exact capability identities
• add trusted private Linux workflow with sanitized provenance and 90-day evidence retention
• preserve FAIL/HOLD without inventing a compatibility cause

Verification

• independent review PASS on d6e47bb
• Node 24.19.0: 158 pass, 0 fail, 1 intentional strict-local skip
• Node 26: 158 pass, 0 fail, 1 intentional strict-local skip
• 10 pinned archives re-fetched and matched canonical hashes and static contracts
• 20 released-Codex environment diagnostics passed with exact source/version/capability binding

Gate

This PR does not claim publication or adoption. The repository and application remain HOLD until the main-branch strict Linux workflow produces all 20 receipts and the artifact is independently reconciled.