Submit the uploads.sh plugin to the OpenAI directory

[zachdunn]

Follow-up to #668 (merged). The packaging is in: plugin manifests, hosted MCP at https://agents.uploads.sh/mcp, tool annotations, securitySchemes, the domain-challenge route, and MCP-vs-CLI routing at the top of the skills.

This issue is the remaining path to a listing. It is not blocked on more code.

Checklist

• Identity verification finishes in the OpenAI developer portal
• Set OPENAI_APPS_CHALLENGE on the MCP worker (wrangler secret put OPENAI_APPS_CHALLENGE --config apps/mcp/wrangler.jsonc)
• Confirm curl -i https://agents.uploads.sh/.well-known/openai-apps-challenge returns the token as text/plain (404 until the secret is set)
• Confirm the post-feat: prepare Claude and Codex plugins for the OpenAI directory #668 MCP deploy is live (challenge route, annotations, www-authenticate on insufficient scope)
• Portal scan of https://agents.uploads.sh/mcp (submit as With MCP, not skills-only)
• Paste annotation justifications and the 5+/3− cases from plugins/codex/submission.md
• Reviewer account: a GitHub-linked uploads.sh user with a workspace, the uploads GitHub App on a writable repo, and no extra MFA after the first OAuth consent

Only if review asks

• Output schemas after Scan Tools → file or pick up the sibling issue
• supportURL rejected because it points at GitHub issues → add a /support page
• ChatGPT OAuth requires UserInfo / openid → we currently 404 /.well-known/openid-configuration on purpose (apps/web/public/auth.md). Do not build a full OIDC surface unless the portal requires it
• ChatGPT still tries to npm install -g or run uploads attach ./shot.png → invert the rest of uploads-cli so MCP verbs lead (routing tables already landed in feat: prepare Claude and Codex plugins for the OpenAI directory #668)

Already tracked elsewhere

• CIMD / better-auth 1.7: chore(auth): upgrade better-auth to 1.7 and adopt CIMD client registration #556
• Plugin vs uploads install as the canonical path: Decide whether the plugin or uploads install is the canonical install path #488

What this is not

Not a skill rewrite, not CIMD, not a connector .app.json unless the portal cannot ingest .mcp.json.

[zachdunn]

Sibling issues now filed:

• Output schemas after Scan Tools: Add output schemas on hosted MCP tools after the first OpenAI scan #671
• Directory hook calling uploads on PATH: Don't call uploads from the OpenAI directory plugin hook #672
• CIMD (already open): chore(auth): upgrade better-auth to 1.7 and adopt CIMD client registration #556