[REQ-099] Extension Manifest/Receipt v2 and main planner

[jinjunnn]

Goal

实现严格 schema、main-only installation plan、scope receipt 与 Hub project context。

Parent requirement

jinjunnn/alpha-code#210

Scope

• Deliver the jinjunnn/alpha-code boundary for Alpha REQ-099: Extension Manifest/Receipt v2 and main planner.
• Preserve the parent requirement contract; do not absorb adjacent repository work.

Out of scope

• Work owned by sibling sub-issues or future REQs.

Acceptance criteria

• 伪造 renderer 输入无效；非法 manifest 写盘前拒绝；scope 独立管理。
• Relevant automated and packaged/runtime checks are attached before closure.

Dependencies

ADR-028；与 REQ-098 联合评审。

Verification evidence

• CI/test evidence.
• Security/runtime/product acceptance evidence appropriate to this repository.

[jinjunnn]

✅ 交付 via PR #242(squash 3024732)。
验收对照:① 伪造 renderer 输入无效 —— 安装意图收窄 {catalogId,scope,grants},未知键 loud 拒绝,安装事实全部 main 侧从已验 catalog 重新派生(78 测:manifest-v2 20 / receipt-v2 24 / planner 34);② 非法 manifest 写盘前拒绝 —— installer 零调用 + installs.json 不存在断言;③ scope 独立 —— global/project 物理分域 + identity fail-closed(rename/symlink/Unicode 均不退化 global 卸载)。
ADR-028 accepted(Phase 0/1 拍板,residual:Hub UI 接线 / legacy 通道下线 / v1 批量迁移触发时机)。
证据:CI 四关全绿;权威门 1207 pass;docs/audits/2026-07-13-s45-visual/README.md。