fix(kmp): use cloneable v0.5.0 source tag

[tgarciai]

Summary

• replace the unclonable bare KMP commit SHA with the existing annotated tag v0.5.0
• require the catalog tag to match the mirrored plugin version and peel it remotely
• make the required kmp-contract check run the literal git clone --depth 1 --branch operation used by Claude Code
• retain the Codex local snapshot mapping and exact source-tree comparison

Evidence before promotion

• reproduced the original bare-SHA clone failure verbatim
• verified remote tag object 7cb5b728bf3d8fd1e16ec1ce9ededbd5931070fb peels to c571544856e4f3d9b074a172ab7bcb772d30aaf9
• Claude clean install: plugin and engine 0.5.0, 13 tools, doctor clean
• Claude real update from plugin and engine 0.4.2 to 0.5.0: clean
• Codex clean install: plugin and engine 0.5.0, one MCP owner, 13 tools, doctor clean
• Codex real update from plugin and engine 0.4.2 to 0.5.0: clean
• exact file parity between the v0.5.0 plugin tree and the Codex marketplace snapshot

No release tag or binary is changed.

Related to underpass-ai/kmp#390.