feat: add marketplace icon

[zeval]

Summary

GitHub Status marketplace entries currently fall back to a letter tile because the package manifest has no icon. This adds an original, theme-safe 128×128 service-health SVG without using GitHub logo artwork, packages the trademark notice, and adds source/archive regression gates for the exact assets/icon.svg path.

The package commands now run Kandev's plugin-pack from the sibling backend module, matching the current plugin template and keeping host tool dependencies out of this plugin's go.sum.

Validation

• TDD red: go test ./server -run TestManifestIncludesPackagedMarketplaceIcon -count=1 failed with an empty manifest icon before implementation.
• go mod tidy && git diff --exit-code -- go.mod go.sum
• test -z "$(gofmt -l .)"
• make vet
• make test (60 test functions / 80 runs including subtests)
• make build
• make package-host verify-package-host
• make package verify-package
• Negative archive regression: after removing assets/icon.svg from a temporary archive, make PKG_OUT=<tampered-archive> verify-package exits 2 (it exited 0 before the fail-closed fix).
• Forced a PATH without sha256sum; make verify-package passed through the stock-macOS shasum -a 256 -c fallback.
• Current Kandev host pkgtar.Install accepted kandev-plugin-github-status-0.1.1.tar.gz through a temporary, uncommitted test overlay and extracted the declared icon.
• Archive inspection confirmed assets/icon.svg, assets/NOTICE.md, all five platform binaries, and the icon checksum 9a1ee869237883251c2ab30fa74dec12d8236c73455a24dccc62c9b3e8b281e7.
• Rendered and visually inspected the SVG at the marketplace's 40×40 display size.

No Kandev host or catalog code change is required: the marketplace already resolves the package-relative manifest icon, and the official index will derive icon_url from the next release.

Release

After merge, run the release workflow from main with bump=patch and dry_run=false to publish v0.1.2. Do not update the marketplace registry pointer manually.

[greptile-apps]

Greptile Summary

The PR adds and packages a theme-safe marketplace SVG and notice, updates the manifest to reference the icon, and adds archive-verification gates to build and release workflows. The new verification recipe does not propagate most failed checks, and its host target assumes a checksum utility absent from stock macOS.

• Adds assets/icon.svg, its notice, and manifest icon metadata.
• Stages assets and invokes plugin-pack from the sibling Kandev backend.
• Adds full-package and host-package archive verification targets.
• Runs package verification in build and release workflows.
• Adds a manifest/SVG regression test and updates development documentation.

Confidence Score: 3/5

The PR should not merge until archive verification reliably propagates failed checks and the documented host verifier handles macOS checksum tooling.

The release gate can accept packages whose asset or checksum checks failed because the final executable loop masks earlier statuses, while the host verification command fails on a supported stock macOS environment.

Files Needing Attention: Makefile

Important Files Changed

Filename	Overview
Makefile	Adds asset staging and archive verification, but intermediate verification failures are masked and host verification is not portable to stock macOS.
.github/workflows/build.yml	Adds the new archive-verification target to Linux build packaging, although the target currently does not enforce most checks.
.github/workflows/release.yml	Gates release packaging on the new verifier, which can still return success after checksum or asset-check failures.
manifest.yaml	Declares the new package-relative marketplace icon.
assets/icon.svg	Adds a static 128×128 SVG using simple shapes and no active or external content.
server/manifest_test.go	Tests the declared icon path and basic SVG dimensions and forbidden-content constraints.

_{Reviews (1): Last reviewed commit: "feat: add marketplace icon" | Re-trigger Greptile}