Automate plugin submissions, labels and upstream release updates

[higanbana986]

Plugin submissions now become catalog review PRs from immutable GitHub Release metadata. A workflow maintains eight labels, reconciles existing submissions, and checks already listed publishers every six hours for their latest stable release. Merging updates only the selected host catalog; plugin builds remain upstream.

The synchronizer validates tag/source identity, metadata and artifact SHA-256/size against GitHub records, host boundaries and immutable history. It never executes plugin code, merges its own proposals or admits changed publisher keys. Privileged events check out only main. English and Chinese guides describe setup, labels, legacy submissions and signed-feed boundaries.

Validation: 14 unit tests, both catalog validators, immutable-history checks, local Markdown links and git diff --check pass. Read-only validation of the actual OAuth v0.0.1 release matched all five artifact records. Automated PR creation requires the repository's standard Actions PR permission; workflow-created checks may need maintainer approval.

新增申请自动生成目录审核 PR，并自动维护状态标签；已收录插件每 6 小时检查最新稳定版。最终收录仍需维护者审核，不自动合并，不重新编译插件。