Harden plugin catalog validation and release signing

[krotname]

What changed

• add strict schema, semantic, duplicate-key, archive, URL, hash, and DLL validation
• make offline catalog and generated-document checks deterministic
• retain the merged transient-download retry behavior in the hardened downloader
• pin workflow actions and Python dependencies by immutable versions and hashes
• isolate OIDC signing from build jobs, sign only the catalog DLL, and verify Authenticode output
• add 30 regression and repository-policy tests

Root cause

The previous validator trusted redirects and archives too broadly, mixed network and local validation, and offered limited protection against malformed catalogs or hostile packages. The release job also exposed signing authority to a broader build scope and selected a floating signing tool version.

Validation

• python -m unittest discover -s tests -v (30 tests)
• python validator.py all --offline
• Python compile check
• YAML parse of both GitHub Actions workflows
• lock file regenerated with Python 3.12 and pip-compile --generate-hashes
• git diff --check for authored changes; upstream catalogs retain their existing CRLF lines