feat(io.github.liushunqiu.pi-idea-git): add IDEA Git tool window

[liushunqiu]

Add IDEA Git v0.3.0 to the community marketplace.

What it does:

• IDEA-style Git tool window: staged/unstaged change lists, hunk-level stage and revert, commit, branch switcher, graph log and stashes.
• Two docked work-panel views (Commit order 33, Git order 35) plus a detached panel entry.

Verification:

• python3 scripts/pack_plugin.py plugins/io.github.liushunqiu.pi-idea-git succeeds (1.06 MB, under 50 MB limit)
• python3 scripts/security_audit.py --check-packages passes with 0 blockers (manual-review signals expected for git process execution, destructive operations and clipboard access; git runs via spawn with argument arrays, no shell)
• python3 scripts/rebuild_catalog.py regenerates catalog.json (22 plugins, sha256 matches the .piplug)
• node --test tests/*.test.mjs passes (165 pass, 1 skipped, 0 fail); python tests 16 passed
• Added tests/pi-idea-git.test.mjs asserting exact manifest identity, permissions and contributions
• Bumped tests/panel-chrome.test.mjs panel count 18 to 19; detached panel documents the v3 46px chrome contract

Capability and data flow:

• Runs the system git binary against the workspace repo root only; no network requests, no telemetry, no API keys held
• Reads workspace files through host fs APIs (Open File / Reveal only); discarding an untracked file deletes it with a confirmation dialog; all other writes go through explicit git commands
• Commit-message drafting calls the host model with the user model setup and quota (host rate limit 8/min)
• HTTPS credentials come from the user git credential helper; ssh-agent-only keys do not work

Checklist:

• Unique id
• Semantic version 0.3.0
• README explains what/why/permissions
• pack succeeds
• catalog.json rebuilt, sha256 matches
• Tested via packed artifact contents and manifest assertions
• No secrets in source or package
• security audit 0 blockers

[vercel]

@liushunqiu is attempting to deploy a commit to the vastsa's projects Team on Vercel.

A member of the Team first needs to authorize it.

[vastsa]

Principle is sound — merging.

This is a high-risk Git UI (system git via spawn argv, no shell; untracked discard / reset --hard; host model for commit drafts). No harm blocker: channels are allowlisted, refs/paths/hashes are validated, repo override stays inside the workspace, credentials fail closed through the user git helper (GIT_TERMINAL_PROMPT=0), and the plugin does not fetch or hold API keys. Catalog merge only adds io.github.liushunqiu.pi-idea-git 0.3.0 (fbf784997dfa…) and leaves the other 21 entries untouched.

Follow-up, not a merge blocker: the three ~288KB HTML copies differ only by title/surface flag.