[Xuepoo]

Priority: P2 | Area: ui/config | Labels: feat,P2,area:ui,area:config,area:plugin | Milestone: v0.1.0 | RFC: configuration-dashboard-candidate.md | Task: CTX-1429

Summary

Onboard bitty-terminal.dashboard as an official plugin. The plugin repository
(https://github.com/bitty-terminal/dashboard) is created and pushed; this PR is
the registry entry, the submodule pin, and the regenerated index.

• registry/official/dashboard.toml: identity, tags, MIT license, sha256 of
  bitty-plugin.toml at the pinned revision, compatibility >=0.0.26,<0.1
  (runtime.inspect) and sdk ^1.0.
• .gitmodules + plugins/dashboard gitlink pinned to
  9c7489573484d09518081df88b8bed629680853f (review-fix revision: flat overlay
  rows, Core wheel wire format, bounded keep-alive, hardened redaction).
• generated/registry.json regenerated with just registry-generate;
  manifest_hash is unchanged because bitty-plugin.toml did not change.

Plugin scope

Read-only MVP per bitty-plugins#106 and bitty#2380: one panel over
bitty.runtime.inspect() (bitty#2410) with Overview, Plugins, Extensions,
Settings, Profiles, and Diagnostics sections. Capabilities are exactly
runtime.inspect + ui.overlay.focus; there is no config.manage, no
filesystem/process/network/clipboard/terminal-input authority, and no
install-time execution.

Settings editing is explicitly deferred until the typed config.manage API
(bitty#2393) lands; the panel title, its read-only note, and the README state
this, and no code path writes configuration.

Verification

• just check in the dashboard repo: markdownlint, prettier, SDK manifest
  lint, SDK README contract, luaparse + luac5.4 -p with a fail-closed
  control, 70 Lua behavior checks (both layouts, direct-child overlay
  flattening, key/wheel navigation, overlay lifecycle plus failed-poll and
  failed-repaint release paths, path/command leak checks), and 8
  manifest/README contract tests.
• Real Core overlay flatten fixture: the plugin scene was parsed by
  UiNode::from_lua_value_in and flattened with Core's flatten_band_runs
  direct-child rule; 7 painted rows with separately addressable content.
• just check in this repo: green (fmt-check, lint, type-check, test,
  registry-validate, registry-check, app-build).
• just registry-validate with the plugin checkout resolvable: 0 errors; no
  manifest-hash diagnostic for dashboard. Remaining warnings are the
  pre-existing unsigned/compat-grammar notices shared by every entry.
• gitleaks detect --source . in the dashboard repo: no leaks.

Registry head: ab194567ccddeec4cb24b0bb726b30665c102924.

Notes for the reviewer

• The capability set is narrower than the four-name list discussed for the
  overlay path: the accepted W-01 spec-path bitty.ui.overlay.acquire(spec)
  mounts the surface directly, so ui.rich and ui.overlay are not
  requested (verified against the host gates in
  bitty-runtime/src/plugin_runtime/services.rs).
• The host paints an overlay-slot block only for the plugin that owns the
  capture session, so a presentation-only mount would never be visible. That
  is why ui.overlay.focus is part of the MVP.
• registry-pins.toml is intentionally untouched (owned by the parallel
  devtools/statusline onboarding task).