ci(kmp): gate the immutable marketplace mirror

[tgarciai]

Closes #25.

Makes KMP marketplace publication deterministic and self-checking:

• Claude now installs the reviewed KMP 0.5.0 plugin tree from immutable commit af452279507d8575d308ffdb9ab7ee01205b9c60, not mutable main.
• The new kmp-contract workflow checks out that exact source and compares every plugin path, byte and executable bit with the Codex snapshot.
• It validates both catalog mappings, aligned host versions, thirteen unique tools, ChronoLoom copy and the 10-memory + 3-view split.
• The workflow runs on every pull request and every main push so it can become a required branch check.

Companion KMP release defense: underpass-ai/kmp#389.

Local evidence:

• python3 scripts/ci/kmp-contract.py --print-source-ref
• python3 scripts/ci/kmp-contract.py --source-root /home/gx10a/Documents/ai/tmp/kmp-market-source/plugins/kmp
• python3 -m py_compile scripts/ci/kmp-contract.py
• git diff --check