feat: add marketplace icon

[zeval]

Summary

Give the latest GitHub Status plugin package a real marketplace icon at the existing package-relative assets/icon.svg path.

• Replaces the interim custom service-health graphic with GitHub's official black Invertocat and supplied clear space from the current GitHub logo package.
• Preserves the official mark path, dimensions, and clear space; a plain white presentation field supplies GitHub's required high contrast in both Kandev themes without host-side provider logic.
• Records source, package member, retrieval date, packaged SHA-256, trademark ownership, and non-endorsement in assets/NOTICE.md.
• Pins the approved packaged SVG digest in the manifest regression test, so a missing, renamed, substituted, or edited asset fails before packaging.
• Keeps the existing fail-closed package verifier: both package targets include assets/, require the manifest declaration and notice, and validate the generated checksums.txt entry.

Official source: https://brand.github.com/foundations/logo
Package member: GitHub Logos/SVG/GitHub_Invertocat_Black_Clearspace.svg
Packaged icon SHA-256: 500cc7f291e1e2dd734539a44f70259f809f18dbcab6e4d208012725967c6878

Verification

• TDD RED: go test ./server -run '^TestManifestIncludesPackagedMarketplaceIcon$' -count=1 rejected the interim icon with SHA-256 9a1ee869237883251c2ab30fa74dec12d8236c73455a24dccc62c9b3e8b281e7.
• TDD GREEN: the same test passes with the approved GitHub asset digest.
• make fmt vet test build
• make package verify-package — verified all five platform binaries plus every checksum.
• make package-host verify-package-host — verified the host-only package target.
• Archive inspection confirmed manifest.yaml declares assets/icon.svg, the tarball contains the exact path and notice, and checksums.txt records the digest above.
• Current Kandev pkgtar.Install accepted the host tarball, revalidated its checksums, and extracted an icon with the same digest.
• Rendered and visually inspected at the marketplace's 40×40 size on light and dark tile backgrounds.
• Existing negative archive and macOS shasum -a 256 fallback regressions remain green.

No Kandev host or catalog code change is required. The marketplace already resolves the package-relative manifest icon, and the official index will derive icon_url automatically from the next release.

Release

After merge, run the release workflow from main with bump=patch and dry_run=false to publish v0.1.2. Do not update the marketplace registry pointer manually.

[greptile-apps]

Greptile Summary

The PR adds and packages a theme-safe marketplace SVG and notice, updates the manifest to reference the icon, and adds archive-verification gates to build and release workflows. The new verification recipe does not propagate most failed checks, and its host target assumes a checksum utility absent from stock macOS.

• Adds assets/icon.svg, its notice, and manifest icon metadata.
• Stages assets and invokes plugin-pack from the sibling Kandev backend.
• Adds full-package and host-package archive verification targets.
• Runs package verification in build and release workflows.
• Adds a manifest/SVG regression test and updates development documentation.

Confidence Score: 3/5

The PR should not merge until archive verification reliably propagates failed checks and the documented host verifier handles macOS checksum tooling.

The release gate can accept packages whose asset or checksum checks failed because the final executable loop masks earlier statuses, while the host verification command fails on a supported stock macOS environment.

Files Needing Attention: Makefile

Important Files Changed

Filename	Overview
Makefile	Adds asset staging and archive verification, but intermediate verification failures are masked and host verification is not portable to stock macOS.
.github/workflows/build.yml	Adds the new archive-verification target to Linux build packaging, although the target currently does not enforce most checks.
.github/workflows/release.yml	Gates release packaging on the new verifier, which can still return success after checksum or asset-check failures.
manifest.yaml	Declares the new package-relative marketplace icon.
assets/icon.svg	Adds a static 128×128 SVG using simple shapes and no active or external content.
server/manifest_test.go	Tests the declared icon path and basic SVG dimensions and forbidden-content constraints.

_{Reviews (1): Last reviewed commit: "feat: add marketplace icon" | Re-trigger Greptile}