feat: add marketplace core

[h1177h]

变更内容

本 PR 新增 marketplace core 相关基础能力，为后续市场能力集成提供底层支撑。

主要包括：

• 新增 marketplace catalog、artifact、installer、resolver、manifest 等核心模型和逻辑
• 新增 marketplace registry client 相关基础能力
• 新增 marketplace 示例 artifact 配置
• 补充 marketplace 配置项及对应校验
• 补充 marketplace/config 相关测试

不包含内容

本 PR 不包含以下内容，后续会通过独立 PR 提交：

• 云端 registry server
• runtime marketplace 集成
• gateway marketplace API
• agent marketplace tools
• capability planner / prompt wiring

测试

go test ./pkg/marketplace ./pkg/marketplace/registry ./pkg/config

[fennoai]

I found 4 issues worth addressing in the marketplace core changes. The main themes are trust-boundary handling around remote downloads and destructive filesystem operations, plus two behavior/config mismatches that are likely to surprise callers.

[codecov]

Codecov Report

❌ Patch coverage is 66.09049% with 667 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/marketplace/store.go	59.60%	132 Missing and 72 partials ⚠️
pkg/marketplace/installer.go	66.08%	67 Missing and 49 partials ⚠️
pkg/marketplace/registry/client.go	59.27%	54 Missing and 36 partials ⚠️
pkg/marketplace/catalog.go	80.24%	60 Missing and 21 partials ⚠️
pkg/marketplace/types.go	10.81%	66 Missing ⚠️
pkg/marketplace/lifecycle.go	67.46%	13 Missing and 14 partials ⚠️
pkg/marketplace/registry/convert.go	73.68%	17 Missing and 8 partials ⚠️
pkg/marketplace/policy.go	81.57%	14 Missing and 7 partials ⚠️
pkg/marketplace/capability_index.go	77.92%	13 Missing and 4 partials ⚠️
pkg/config/normalize.go	23.07%	5 Missing and 5 partials ⚠️
... and 1 more

📢 Thoughts on this report? Let us know!