feat(market): StaticRegistryRepository for the extension registry (#1487, part 5a)

[ZhuchkaTriplesix]

Part of #1487, step 4: the app side of the extension registry.

StaticRegistryRepository reads index.json (default https://queryahub.github.io/extensions/index.json, produced by the registry repo's CI) instead of a MarketApi server.

• Extends HttpMarketplaceRepository, so install is the existing pipeline: SHA-256, archive limits, path-traversal guard, sandbox policy. Only the list and the download rule are new.
• Lists/searches the index; hides yanked entries, entries without a checksum, URLs that are not https://github.com/<o>/<r>/releases/download/<tag>/<asset>, and extensions whose engines.querya_desktop range excludes the running version (engineRangeAllows, made public from the harness validator; an unreadable range stays visible, as before).
• Refuses an index with another schema instead of half reading it; one malformed entry does not hide the rest; the index is cached for 10 minutes and the last good copy is served when a refresh fails.
• Downloads accept only GitHub release assets (the redirect ends on githubusercontent hosts).
• Not wired into the UI: the Marketplace page still uses the mock repository, which is the 0.5.0 "live Marketplace" work. Tests only for now (index parsing, filtering, cache, URL rule, install with a good and a wrong hash). Not run locally; CI decides.