Design plugin sources, lockfile, and provenance model

[yacosta738]

Goal

Define the AgentSync-native contract for declaring marketplace plugins reproducibly. This is the design and schema slice; implementation follows only after the vendor revalidation in #573.

Scope

• Typed agentsync.toml configuration for marketplaces and selected plugins.
• A committed lockfile containing resolved marketplace/plugin revisions and content hashes.
• Source types and authentication boundaries for public and private Git repositories.
• Stable plugin identity, marketplace identity, version semantics, and collision rules.
• Backward compatibility with the existing skill registry.json; do not overload it with plugin state.
• Explicit policy for mutable refs, offline apply, update, remove, and drift detection.

Security requirements

• Never persist credentials or tokens in TOML/lockfiles.
• Resolve mutable refs only during an explicit add/update operation.
• apply must use the lockfile and fail closed when a required pin or hash is unavailable.
• Define archive size, path traversal, symlink, and unsupported-component validation.
• Do not execute plugin hooks/scripts during resolution or apply.

Deliverables

1. OpenSpec proposal, exploration, design, and tasks.
2. Typed config and lockfile schema with examples.
3. Resolution state machine and error contract.
4. Decision record for cache/generated paths versus committed source.
5. Focused parser, serialization, pinning, and drift tests.

Acceptance criteria

• Schema supports at least one marketplace with multiple selected plugins.
• Reapplying the same lockfile is deterministic and offline-capable when materialized content is cached.
• Updating a ref changes the lockfile only through an explicit update flow.
• Provenance can answer where every materialized component came from.
• Open questions and out-of-scope vendor-specific components are explicit.

[linear-code]

DALLAY-586