Publish the scope catalog as an independently versioned public dependency

[callumflack]

Summary

Implements BUI-720:

• adds the JSON-first @opendatalabs/scope-catalog package with the required exports and package-relative payload schemas
• adds deterministic contract fingerprinting, semantic version classification, cumulative changelog, and release.json
• adds package build/check/test tooling and a path-triggered publication workflow
• preserves the completed BUI-705 catalog, Web truth, executable connectors, installers, resolver/OTA behavior, connector index, consumer-update workflow, Unity, and Starter

Release safety

• merging or pushing while the npm package is absent cannot publish 1.0.0
• initial publication requires a confirmed workflow_dispatch and is the only step that receives the temporary bootstrap token
• later releases use npm trusted publishing via OIDC with no NPM_TOKEN
• unchanged contract fingerprints skip publication
• every publish path rechecks that the checked-out SHA is still current main immediately before npm publish

Validation

• npm run scope-catalog:check
• npm run scope-catalog:test — 14/14
• npm run scope-catalog-package:build
• npm run scope-catalog-package:check
• npm run scope-catalog-package:test — 10/10
• npm pack ./packages/scope-catalog --dry-run --json
• two consecutive builds are byte-identical
• tarball contains 56 files, 50 unique catalog pairs, and every referenced schema exactly once
• clean temporary consumer imported every required export
• final independent autoreview reported no actionable findings

No workflow was dispatched and no package was published.

[github-actions]

Schema Health Check — Non-blocking inherited issues

44/50 scopes consistent | 6 inherited Gateway gap(s) | no new blocking issues in this PR