Add ConfigQuote plugin

[mraf]

What this PR does

Adds the ConfigQuote plugin: product configuration and quote workflows for merchants, via the merchant's own ConfigQuote MCP server.

• Plugin name: configquote
• Type: remote source
• Source URL + pinned SHA (remote), or vendored path (local): https://github.com/ConfigQuote/configquote-agent-plugins.git @ 5aa1a08dfd2833b256070ecd04007ac92825bb83, path plugins/grok
• Homepage: https://configquote.com/

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (or I've explained why not below).

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set; local plugins include README.md + .grok-plugin/plugin.json.
• License is stated (MIT, in the repo's LICENSE).

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege.
• Network endpoints this plugin calls (and why): only the user's own ConfigQuote tenant MCP endpoint (CONFIGQUOTE_MCP_URL, https://<tenant-domain>/mcp), to run configuration and quote tools.
• Credentials/permissions it requires (and why): CONFIGQUOTE_ACCESS_TOKEN, a bearer token the merchant generates in their ConfigQuote admin. It is referenced only in .mcp.json as the Authorization header for that endpoint. The plugin has no hooks, scripts or telemetry.

Notes for reviewers

ConfigQuote is a tenant-based SaaS, so each merchant connects their own tenant URL. The plugin ships four skills (workflows, create-quote, edit-quote, generate-3d-model) and one HTTP MCP server definition.