Add Calibrd Agent (calibrd)

[justinxcguo]

What this PR does

Adds Calibrd Agent as a new remote-source plugin. It gives Grok six tools that run
against the person's own Calibrd account: score a job posting against their CV,
generate the full report (gaps at their level, the questions each round asks, the
interview process, a pay benchmark), review a CV, draft a cover letter, check
status and get a pass.

• Plugin name: calibrd
• Type: remote source
• Source URL + pinned SHA: https://github.com/Calibrd/calibrd-agent.git @ 89d8cb8a63c335fae56a9937215d7a1b3831a469
• Homepage: https://www.calibrd.com/agent

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org.

The source repo is github.com/Calibrd/calibrd-agent, the Calibrd org. The
homepage is on the same brand domain, and that domain publishes the Ed25519
domain proof for Calibrd's entry in the official MCP registry at
https://www.calibrd.com/.well-known/mcp-registry-auth (registry name
com.calibrd/agent), so the brand, the domain and the source repo all line up.

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set.
• License is stated (MIT, in the source repo).

Security

The plugin ships one Streamable HTTP MCP server and one skill. No hooks, no
commands, no agents, no scripts, nothing that runs locally.

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege.
• Network endpoints this plugin calls (and why): https://www.calibrd.com/mcp only —
  the Calibrd MCP server, which runs the six tools listed above.
• Credentials/permissions it requires (and why): an OAuth sign-in to the user's own
  Calibrd account, so the tools read and meter against that account. No API keys, no
  filesystem access, no environment variables.

Data handling, stated the same way on the listing page: the CV, the job description
and the report pass through the assistant's provider under their terms. Calibrd
itself keeps none of it — reports and CVs are generated and returned, not stored.

Notes for reviewers

https://www.calibrd.com/mcp answers an unauthenticated probe with 401 and a
WWW-Authenticate header pointing at
https://www.calibrd.com/.well-known/oauth-protected-resource/mcp. That is the
OAuth handshake working, not a broken endpoint — a client follows it to sign in.