feat(distribution): publish hardened sample catalog

[kraus-it]

Summary

• harden the remaining eleven existing samples for independent template distribution
• package all fourteen ready templates deterministically with pinned build metadata
• remove raw-token UI and require validated OIDC identity before establishing sessions
• add lockfiles, ignore rules, generated CI, and catalog-wide packaging regression tests

Validation

• distribution manifest: 20 templates (14 ready, 6 planned)
• distribution tests: 15/15 passing
• React/Lovable/Vue/Angular production builds passing
• Android debug build, Flutter analyze, Swift parse passing
• Express, Flask, Go, PHP, Laravel checks passing
• production dependency audits clean where supported

Review policy

This PR intentionally remains open. Later slices are stacked on top of it until the six-slice epic is complete.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[kraus-it]

@claude Please review this PR, including the distribution safety boundaries, generated satellite repositories, and OIDC session establishment changes. Do not modify files; report actionable findings.

[kraus-it]

Slice 3 validation complete:

• 16/16 distribution tests passing; 20-template manifest valid
• all 11 new satellites verify byte-for-byte against source commit 4230326
• fresh-clone builds pass for Lovable, Vue, Angular (Node 24.15), Android, iOS, Flutter, Express, Flask, Go, PHP, and Laravel (Composer container)
• Claude workflow was triggered, but the run explicitly reports that CLAUDE_CODE_OAUTH_TOKEN is not configured; no Claude findings were produced

This PR remains intentionally open while Slice 4 is stacked on it.

[kraus-it]

@claude Please review the current head of this PR. Focus on correctness, security, distribution/sync behavior, reproducibility, and tests. Report only actionable findings; if clean, state that explicitly.

[kraus-it]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4230326da1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kraus-it]

Review follow-up complete on current head 9ba2b97.\n\nAddressed all three open Codex threads:\n- Flask now uses a server-side Flask-Session CacheLib store; only an opaque session id is cookie-backed.\n- Token/UserInfo session state is committed only after UserInfo succeeds, with defensive cleanup on failure.\n- Go preserves the UserInfo error while clearing one-time OAuth state.\n\nThe earlier local Claude review findings are also included in 513d472. Verification: clean Python 3.13 install/import/session smoke test, Go 1.25 test/build, and 16/16 Slice 3 distribution tests. A local Claude re-review explicitly confirmed the three fixes and found no remaining blocking correctness or security issue.\n\nAll review threads are resolved. The PR remains open as requested.