feat(registry): graduate verification and its type/lexicon dependencies to main

.changeset/graduate-registry-verification.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/registry-verification": minor
+---
+
+Adds `@emdash-cms/registry-verification`: runtime-neutral primitives for verifying plugin registry release artifacts. Validates multihash checksums, fetches artifacts with size and redirect guards, checks canonical tarball and bundle structure, and verifies Sigstore build provenance. Runs on both Node and workerd.

.changeset/lexicons-profile-extension.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/registry-lexicons": minor
+---
+
+Adds the `packageProfileExtension` lexicon and its generated types, plus a `provenance` reference field on the package release extension.

.changeset/plugin-types-manifest-schema.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/plugin-types": minor
+---
+
+Adds plugin manifest schema validation (`pluginManifestSchema`, `reconcileManifestAccess`) and declared-access canonicalization helpers (`canonicalizeDeclaredAccess`, `diffDeclaredAccess`, escalation detection, and the `CanonicalDeclaredAccess` types) for validating plugin manifests and comparing the access a plugin declares.

packages/plugin-types/package.json

@@ -42,5 +42,8 @@
 		"url": "git+https://github.com/emdash-cms/emdash.git",
 		"directory": "packages/plugin-types"
 	},
-	"homepage": "https://github.com/emdash-cms/emdash"
+	"homepage": "https://github.com/emdash-cms/emdash",
+	"dependencies": {
+		"zod": "catalog:"
+	}
 }