chore: align repository with fleet contracts

[jmagar]

Aligns this repo's CI workflows and docs with current fleet-wide conventions.

• Updates actionlint config and reusable workflow pins across ci.yml, publish.yml, release-please.yml, and synthetics.yml
• Adjusts Android/Kotlin build config (Tauri gen build.gradle.kts, RustPlugin.kt)
• Adds/updates fleet-standard notes in docs (component-kotlin-map, deployment, gallery-complaint-matrix, security, versioning)
• Bumps plugin manifest version
• Follow-up commit refreshes the pinned reusable workflow library revision

[jmagar]

Addressed the review findings on this PR:

1. Required status checks now match. The branch ruleset requires literal contexts Workflow and dependency policy, OSV dependency scan, Web, registry, and standalone, and Android app and library variants. A uses: reusable-workflow job always reports as "<caller> / <called-job>", so policy, web, and the restored android job are kept as plain inline jobs whose name: matches those contexts exactly (the fleet-contract.yml and fast-ops/fast-pnpm migration is otherwise unaffected — contract, gradle-wrapper, and dependencies keep using the shared library).
2. Android PR-time job restored — androidCheck, androidManagedDeviceCheck, and ops/smoke-android-composite.sh, on ubuntu-latest (unchanged from before; matches the fleet's own hosted-android-release.yml, which also runs on a GitHub-hosted image rather than a self-hosted pool).
3. web job build ordering fixed — pnpm run build now runs before pnpm run audit:standalone (which requires .next/standalone to exist), and performance:check + test:e2e are restored.
4. plugin/.claude-plugin/plugin.json — version restored and bumped 0.1.0 -> 0.1.1.
5. .github/actionlint.yaml — verified: ci-pool-ops/ci-pool-typescript are already allowlisted and actionlint runs clean against the rewritten ci.yml; no further self-hosted labels are introduced (the restored Android job stays on ubuntu-latest).
6. pnpm audit --audit-level high gate — added/raised pnpm-workspace.yaml overrides for undici (7.28.0 -> 7.29.0), fast-uri (3.1.4 -> 3.1.5), ip-address (10.2.0 -> 10.3.1), and brace-expansion (5.0.8 -> 5.0.9), and refreshed pnpm-lock.yaml. pnpm audit --audit-level high now reports zero vulnerabilities. Also bumped the pre-existing hono (4.12.27 -> 4.12.34) and postcss (8.5.19 -> 8.5.23) overrides, which were stale against newer advisories and were failing the separate required OSV dependency scan check (osv-scanner isn't filtered by pnpm audit's severity gate).

Verified locally: actionlint clean, ops/check-action-pins.sh clean, pnpm run build then pnpm run audit:standalone passes in that order, pnpm run {lint,test:unit,tsc --noEmit,registry:check,registry:validate,registry:graph,gallery:check,catalog:check,tokens:generate,refs:check,performance:check,audit:composition} all pass with no generated-artifact drift, pnpm audit --audit-level high → 0 vulnerabilities, and docker run ghcr.io/google/osv-scanner:v2.3.8 --lockfile=pnpm-lock.yaml (the exact image CI uses) → "No issues found". CI on this PR now shows all four required contexts passing.