Prepare v0.5.1: publish the bundle and the CLIs

[snkmcb]

What

This PR prepares v0.5.1. It changes no behaviour; it changes what gets published. execMotion and the three CLIs go to ghcr.io/animu-sphere/usd-motion-plugins next to the libraries, so another repository can pin them by digest.

Three commits:

1. Move the pin to 0.23.4, with the ecosystem. Updates openstrata.ci.yaml, the re-rendered workflow (only the version changes) and release.yml (which mirrors the pin by hand).
2. Publish the bundle and the CLIs with the libraries (release.yml):
   • Every packaged bundle and tool is staged as a whole dist directory, the way a library is, with a member-digests.tsv row that records its kind.
   • The publish job imports all of them and pushes each one under <member>-<version>-<target>.
   • The pin table (external-library-pins.{md,json}) gets bundles and tools sections. Each Markdown block can be pasted directly under requires.bundles or requires.tools.
   • Each kind's expected count comes from the tree (the openstrata.plugin.yaml / openstrata.tool.yaml descriptors), so a member that stops being packaged fails the job.
3. Prepare v0.5.1. VERSION and its 24 mirrors, a finalized ## [0.5.1] changelog section, docs/releases/v0.5.1.md, the notes template, and the roadmap.

Why

ost 0.23.4 added requires.bundles[].artifact and requires.tools[], in answer to usd-vrm-plugins' ost report 45. usd-vrm-plugins cannot delete its copy of execMotion until it can pin the published bundle and re-run its parity rows against it. v0.5.0 attached the bundle and the CLIs to the release but never pushed them, so nothing existed for a pin to point at.

Checked locally (Windows, ost 0.23.4)

• Root ost build + ost test: 53 of 53 pass, at both 0.5.0 and 0.5.1. ost plugin build and ost plugin test --up-to 5 for execMotion pass. ost plugin package --workspace packages all four members at 0.5.1.
• Push rehearsal: each bundle and tool dist directory was imported, then pushed with ost artifact push to a throwaway registry (registry:2 in WSL, --plain-http). Every push returned the artifact_digest it was given and an oci_digest, the two fields the job reads.
• Pin-table script: run against synthetic rows. It emits the three sections, and it fails when a kind's count does not match the tree.
• Consumer rehearsal in usd-vrm-plugins (scratch branch, discarded afterwards):
  • Deleted plugins/execMotion and pinned the locally built bundle. ost plugin test plugins/execVrm materialized it under .strata/external-bundles/ and put it on the session's plugin path.
  • Inside ost plugin run plugins/execVrm -- ctest …, these pass against it: execVrm_retarget, _joint_transforms, _diagnostics, _retarget_without_exec_motion, workspace_exec_driver, and all five workspace_exec_parity_* cases (divergence 0 everywhere).
• check_docs.py and make_release_notes.py --version 0.5.1 pass.

Not proven by this PR

The GHCR push itself. No PR event runs release.yml. The tag push is its first run, as it was for v0.5.0. The new rows use the same credentials and the same command as the library rows.

After merge

Tag v0.5.1 from the merged main, then publish the draft release. The pin table it generates is what usd-vrm-plugins will paste.

🤖 Generated with Claude Code