catalog: re-pin dependency links to a reachable commit; verify pins in CI - #25

…#29)

Closes #22 — proposal 3 is the last piece.

## What was already fixed before this PR

Proposals 1 and 2 landed in #25:

- `.github/workflows/validate.yml` runs `bash
scripts/validate-catalog.sh` on every `pull_request` and on `push` to
`main`, with `fetch-depth: 0` and a read-only token, no deploy step.
- The validator was extended with exactly the checks the issue named:
every `schematic`-kind pin resolves (commit reachable from history, file
present at it, sha256 matches, pin text's version equals the linked
file's frontmatter), every
`modules/`/`scripts/`/`skeleton/`/`templates/`/`assets/` path a spec
references exists in the package, and every `composes[]` name exists in
the catalog. Run on `main`: `catalog ok: 19 entries, featured=[...], 18
specs, 21 pins verified`.

## What this PR adds

Proposal 3, the stronger of the two options: the rule is now enforced
instead of softened.

- `.github/workflows/require-issue.yml` fails a pull request whose body
references no issue (`#N`), with a check message that cites rule zero
and links `CONTRIBUTING.md`.
- The job is exempt for `OWNER`, `MEMBER`, `COLLABORATOR` and bots. Rule
zero exists so that an outside contributor's idea gets a public
discussion before anyone spends effort; someone with push access does
not need that gate, and a bot cannot open an issue.
- `CONTRIBUTING.md` now names the workflow and states the exemption, so
the promise and the automation say the same thing.

## Note on proposal 4

Issue #8 (GitHub Pages previews) is superseded, not pending: Cloudflare
Pages deploys every PR and comments the preview URL — see the bot
comment and the passing `Cloudflare Pages` check on #19. #8 can be
closed.

## What is proven live, and what is not

The **skip** path is proven on this PR: the `reference` check appears
and reports `skipping`, because the branch was pushed by a collaborator.
The **fail** path is proven only as a shell test (`no issue link` → exit
1, pasted above): exercising it on GitHub needs a pull request from an
account that is not a collaborator, which cannot be arranged from here.
Worth a one-off check the next time an outside contribution arrives.

…ons copied from frontmatter (#27)

Closes #23.

## What was already resolved before this PR

Two of the issue's findings no longer hold, both fixed by #18/#25:

- **`status`:** the canonical companion
`schemas/spec-1/SCHEMATIC.md.schema` now documents `draft | published |
stable | superseded`, so the 14 `published` packages are compliant. No
package changes status here, and no vocabulary is invented.
- **`spec:`:** present in all 18 specs, and
`scripts/validate-catalog.sh` fails when it is absent or names a missing
companion.

## What this PR fixes

1. **`created` and `updated` on the 13 packages that omitted them.**
Both are derived from history, not invented: `created` is the date of
the first commit that added `schematics/<name>/`, `updated` the date of
the most recent commit that touched it (`git log --diff-filter=A` / `git
log -1`). They are frontmatter fields an author now maintains by hand,
which is what the companion asks for.
2. **Description parity on 8 packages.** The companion says a catalog
`description` is copied from the `SCHEMATIC.md` frontmatter, so the
frontmatter wins and `.agent-schematics/marketplace.json` was synced to
it. The differences are real edits (a `+` vs `and` in
`encrypt-container-secrets`, em-dashes replaced by hyphens, a dropped
clause, `every media arr` → `every media *arr`), not whitespace.

The authoring plugin's own catalog entry is deliberately **not**
touched: its `spec` field names `skills/create-schematic/SKILL.md`, a
skill file with its own YAML `description`, so copying that into the
plugin entry would have replaced a plugin description with a skill
description.

## Verification

```
$ bash scripts/validate-catalog.sh
catalog ok: 19 entries, featured=[...], 18 specs, 21 pins verified
```

Plus a direct check of the companion's REQUIRED fields and status enum
across all 18 specs: **0 failing**.

Executing it: apply a single expression to each pair. python3 with
simple regexes to sweep 18 frontmatter blocks (name, version, status,
spec, description, created, updated).