feat: add Pi extension marketplace

[klioen]

Summary

Adds a Pi Extension Catalog to Settings so users can browse community extensions and manage user-scoped packages without leaving SpireCode. Installed extensions are the default view; Marketplace data is loaded only when opened.

Related work

• Issue: None
• Accepted intent/spec/plan: docs/pi-extension-marketplace/

Changes

• Add a fixed-origin, bounded Main-process adapter for the server-rendered pi.dev package catalog.
• Add Marketplace search, sorting, pagination, community trust labels, install confirmation, and restart guidance.
• Add user-scoped install, update, uninstall, and safe local-package reference removal through Pi's DefaultPackageManager.
• Distinguish npm packages from local sources: npm packages expose Update/Uninstall; local packages expose Remove from Pi without deleting source files.
• Locate a complete Node.js/npm runtime for Finder-launched desktop sessions when Pi has no explicit npmCommand.
• Add narrow IPC contracts, typed Renderer bindings, English/Chinese copy, responsive styles, SDLC artifacts, and regression tests.

Risk and boundaries

• Regression risk: Settings extension inventory and package mutation paths change; covered by Main service, IPC, inventory, and UI tests.
• Security/privacy impact: Catalog access is restricted to https://pi.dev/packages, with bounded redirects, timeout, content type, body size, card count, and validated outbound links. Renderer receives parsed data only and never renders remote HTML. Package mutations accept only exact configured user sources.
• Data or configuration migration: None. ~/.pi/agent/settings.json changes only after explicit install/remove actions. Removing a local source deletes only its settings reference.
• Platform/package impact: No dependency changes. Runtime discovery covers inherited PATH, NVM, Volta, fnm, Homebrew, and standard Windows Node locations.
• Rollback approach: Revert this commit; existing Pi settings and installed package storage remain compatible.

Verification

pnpm check
# 71 test files passed; 487 tests passed; format, brand, i18n, secrets,
# licenses, lint, typecheck, and release tests passed.

pnpm bundle
# macOS arm64 app signature verification, App smoke, and DMG smoke passed.

git diff --check
pnpm secrets:check
# passed; 502 tracked files scanned after staging.

• Tests cover new or changed behavior.
• pnpm check passes locally.
• pnpm bundle passes on the affected local macOS arm64 target; cross-platform CI remains authoritative for Windows/Linux.
• UI screenshots are not included; behavior is covered by Settings UI tests and a locally installed app build.

Contributor checklist

• I read CONTRIBUTING.md and the repository AGENTS.md.
• The change follows the accepted intent/spec/plan.
• Renderer/Main authority, relative-path validation, Git argument arrays, and credential boundaries remain intact.
• Public docs and CHANGELOG.md are updated.
• The diff contains no credentials, private data, unrelated generated files, or accidental dependency updates.
• I reviewed the diff for correctness, security/privacy, and compliance with accepted scope.