Add a Query Graphs MCP App plugin with GitHub Release delivery

[alendit]

Open local query plans inside Codex using the existing Query Graphs renderer and source-document UI. The Git marketplace plugin starts a small Node launcher that downloads a version-pinned, SHA-256-verified runtime from GitHub Releases, allowing installation without a local build or dependency installation.

The MCP adapter exposes one open_query_plan tool. It reads the plan and optional SQL once and delivers them to the viewer in private result _meta, with an 8 MiB serialized response budget. The browser shell reuses the existing loaders, graph, source documents, file opener, and theme handling. A tag workflow rebuilds and verifies the release bundle before publishing it; release preparation documents publishing the asset before merging its pin to main.

Validation:

• GitHub Actions build passed on da65cb0: lint, full tests, workspace build, plugin typecheck, and release-pin verification. Credential scanning, SAST, and CLA checks also passed.
• 9 plugin tests pass using the repository's Node/assert and JSDOM approach. They cover bundled HTML boot/render, source documents, theme/display state, private plan/SQL results, serialized size limits, cache integrity, and offline startup.
• The installed Codex app-server preserved exact private text for the largest repository fixture (260,746 bytes) and a synthetic 7 MiB payload.
• The refreshed local Codex installation exposes only open_query_plan; its verified cached runtime loaded a real Hyper example and served the bundled app while offline.

Draft limitations: live browser geometry remains unverified because no browser surface was available. The plugin-v0.1.0 GitHub Release is not yet published; publish its pinned asset before merging so cold marketplace installs can start. The local installation uses the verified prebuilt cache.