Add marketplace plugin submission skill

[SawyerHood]

Summary

• Add a built-in submit-a-plugin skill for complete BB Official marketplace submissions.
• Cover Git tags, npm releases, entry metadata, descriptions, icons, validation, forks, and pull requests.
• Require separate release approval and disable implicit npm lifecycle scripts.
• Add a safe plugin ID helper and a local fallback for hosts without gh.
• Remove bb plugin submit, the app and SDK submission surfaces, and all Google Form references.

Why

The BB Official marketplace now accepts reviewed entry pull requests. Agents need a current workflow that prepares the plugin release and the listing together.

Validation

• Type checks passed for the app, CLI, domain, SDK, plugin SDK, server, and templates packages.
• Skill discovery and built-in skill copy tests passed.
• Plugin ID, hostile metadata, release safety, and no-gh tests passed.
• CLI guide and plugin catalog tests passed.
• Plugin detail, SDK, and template tests passed.

AGENT GENERATED: by GPT-5.6

[bb-slop-cop]

🚨 SLOP COP 🚨 · review

I am reviewing this pull request now. I will check security, code quality, performance, architecture, and the full user path.

[bb-slop-cop]

🚨 SLOP COP 🚨 · review

Plain-English summary: This PR replaces the old Google Form with an agent skill for marketplace submission. The skill can prepare releases and open listing pull requests. The app and SDK now link to the public marketplace repository. The PR also removes the CLI submission command.

I found these issues:

• High: Plugin display names enter double-quoted shell commands. Hostile metadata can execute shell command substitutions.
• High: A submission request can push a Git tag or publish npm without separate approval.
• High: The npm commands can run implicit lifecycle scripts while release credentials exist.
• Medium: Removing bb plugin submit breaks the repository rule that requires both SDK and CLI surfaces.
• Medium: The skill omits the documented path for hosts without gh.
• Medium: The skill does not use the full product algorithm for plugin IDs.
• Low: The plan still says that a private intake stores contact email. That intake no longer exists.

Architecture review found no new server work or duplicate runtime path. Restore the CLI through sdk.plugins.catalog.submission(). Use one authoritative plugin ID algorithm. Keep free metadata out of shell source.

Performance review found no material regression. The skill description and repeated checks add small costs only.

QA results:

• Chromium showed the action for a direct plugin. It opened https://github.com/get-bb/marketplace with window.opener set to null.
• The focused review suites passed 103 tests. The affected package type checks passed eight tasks.
• All required GitHub checks passed for the exact head SHA.
• A broad local run passed 1,647 server tests. Eleven unrelated tests timed out during heavy concurrent repository work.

I left six inline comments with specific fixes and tests. I did not submit an approval or a request for changes.