fix(registry): read manifest metadata and preserve overrides

[boudra]

The registry now reads display metadata from the pinned paseo-plugin.json, with existing listing overrides taking precedence per field. Selecting the Themes category no longer rejects a submission for lacking screenshots; the PR reviewer determines what the plugin does and applies the content requirements.

Refs #152.

Changes

• Replace the paseo-listing.json reader with one manifest metadata resolver shared by publication and artifact validation. npm reads use the verified tarball; Git reads use the pinned commit and plugin directory.
• Preserve listing.name, listing.icon, and listing.media, including an explicit empty media array. Keep the issue title's existing name override. No records are migrated or renamed.
• Resolve relative icons and media to URLs at the artifact pin, preserving media order. External HTTPS media URLs remain unchanged. Keep the existing public format and supported file extensions.
• Remove the category-based screenshot gate. Metadata parsing checks types and safe paths; it does not decide whether a plugin needs screenshots or whether its content meets review policy.
• Update author documentation with manifest fields, examples, and override precedence. Clarify in the review policy that categories are organizational labels.

Verification

• Failing-first regressions reproduced ignored manifest fields and a screenshot-free submission rejected solely because Themes was selected.
• npm test: 140 tests passed. Includes real npm tarballs, pinned Git fixtures, per-field overrides, empty media overrides, ignoring the retired listing file, and a submission reaching PR creation without screenshots.
• npm run validate: 210 records well-formed.
• npm run validate -- --online: all 210 records matched their pinned artifacts.
• npm run build: generated all 210 listings. Checked the generated index's public schema and every existing record override.
• The monorepo build regression verifies manifest metadata in both index summaries and detail documents.

Scope

No changes to plugin records, the published index format, overview/provenance rules, or getpaseo/paseo. No issue comments or live submission runs were made. Screenshot and content decisions remain with the existing PR review workflow.