Add git companion plugin

[Thomas-Philippot]

Plugin

• Id: tphilippot/git_companion
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

Monitor git repositories from the Noctalia bar. See your current PRs/MRs and issues at a glance.

External dependencies

• Network: each refresh calls the GitHub or GitLab API through the installed
  CLI (gh search prs/issues or glab mr/issue list), scoped by your repo or
  group setting.
• Processes: the service spawns gh or glab for fetches; the panel spawns
  xdg-open (non-blocking) when you click an item.
• Filesystem: nothing is written to disk — plugin state is in-memory only and
  is cleared when the plugin stops.
• GitLab scope: GitLab requires a repo or group scope in settings; the
  service shows an error notification if neither is set.

Testing

Tested on hyprland with both glab and gh with opened pr and mr, issues etc.

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor:
• Noctalia version tested against: 5.0.0
• Plugin API level: 23

Screenshots / Videos

Checklist

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the
  README template, documents
  every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
  understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[ItsLemmy]

1. blocking - git_companion/service.luau:54

The repo and group setting values from git_companion/service.luau:5-6 and
git_companion/service.luau:19-23 are concatenated into a shell command without quoting, then
executed by noctalia.runAsync at git_companion/service.luau:90. The string form of runAsync
executes through /bin/sh -c. A setting such as owner/repo; therefore runs an additional
command with the user's privileges on every refresh.

Shell-quote every dynamic argument before concatenation, or use a direct argv-based process API if
one becomes available to plugins.