[Knapp-Kevin]

Closes #570 after merge.

Exact bounded result

• Registered openai/plugins dynamic-discovery revision 0722921d5542fc593105c27bd52630babd8b8c2a, Build macOS Apps 0.1.4, plugin tree b150c7ad29479b9431f9028a281f5667ea3a673a.
• 11/11 canonical direct front-mattered skills, 11 exact package-tree SHAs and SKILL.md blob SHAs, individual freshness, trigger/non-trigger, source dependencies, authority, portability, controlled tags, candidate score and rationale.
• 3 REFERENCE-ONLY / 8 REJECT unchanged; 0 admissions. No scan or behavioral execution. MIT manifest label lacks controlling root/plugin license text, so copying is NOASSERTION.
• Macro findings: unapproved git init, pkill, rm -rf, project scripts/config writes, local test/build/run, public OSLog item IDs, and sensitive log access. Preserves differentiated AppKit, native windowing, and signing/notarization methods as reference evidence.
• All five public surfaces reconciled atomically at tranche level: README, SYSTEM_STATE, CURATION_QUEUE, INDEX, index.json. Official finite plugin candidate decisions 63→74, reference-only 29→32, rejected unchanged 34→42. Governed inventory 44 first-party / 995 third-party / 1,039 pairs, 23 sources, 12 pinned corpora unchanged. Admitted denominator delta 0, new provenance/verification pairs 0.
• Six passive documentation/evidence files only; no runtime, scripts, CI, tests, scanner, scheduler or upstream vendoring.

Lifecycle

All eight pre-existing issues and five draft PRs were triaged. #489/#492/#496 remain held for 36 exact changed first-party package trees requiring full pinned external SkillSpector v2.12.0 reports and independent adversarial acceptance; shared registry reconciliation is still needed. #412/#413 have separate admission gates. This PR is disjoint from those paths.

Qualification

Static source inspection only. No green CI, semantic verified, package security pass or behavioral validation is claimed. The PR should be merged only after current-head, file scope, and accounting recheck; no CI workflow should be triggered ([skip ci] commit).