feat(registry): onboard official bar plugin

[Xuepoo]

Priority: P1 | Area: area:plugins | Labels: feat,P1,area:plugins | Milestone: v0.1.0 | RFC: ADR-0014 | Task: CTX-0031 | Plan: W-122

Refs #65

Summary

Onboards the official bar plugin (https://github.com/bitty-terminal/bar) to the registry, the reverse of the statusline-removal pattern in #69. Bar is the single workspace/status plugin per DEC-W104-3.

• Added: registry/official/bar.toml (id bitty-terminal.bar, MIT, productivity).
• Added: plugins/bar submodule pin at fcc02f6 (bar main tip; includes R1 seq-labels bar#3 and R2 scratchpad render bar#4) plus the [submodule "plugins/bar"] entry in .gitmodules.
• Bumped: sdk submodule pin c9c962f -> d915535 (reviewer NEEDS-FIX item 7; commit 5f42eac). The old pin predates the workspace-capability commit 4f9f1ba (CTX-0063/B1 #134), so the pinned-SDK closed capability set lacked workspace.read/workspace.control. No SDK code change needed — verified present at SDK main.
• Regenerated: generated/registry.json via just registry-generate (5 -> 6 plugins). Generated artifact was never hand-edited.

Evidence (isolated worktree at clean origin/main 9abdfa9, submodules initialized)

• Source pin verified: git ls-remote https://github.com/bitty-terminal/bar.git HEAD = fcc02f6... = recorded gitlink = local checkout HEAD.
• SDK pin verified: git ls-remote https://github.com/bitty-terminal/bitty-plugin-sdk.git HEAD = d915535... = recorded gitlink; workspace.control present in src/ at d915535 and absent at c9c962f; range c9c962f..d915535 contains 4f9f1ba.
• Manifest hash verified: sha256 of bitty-plugin.toml raw bytes at the pinned revision = sha256:947df761...; registry id/name/license match the pinned manifest (validator manifest-consistency, 0 errors).
• bun scripts/generate-index.ts --check: index up to date (6 plugins).
• bun scripts/validate-registry.ts WITH submodules initialized (sdk + all six plugins/*; SDK manifest tooling active from the submodule checkout, all 6 manifests linted): 0 errors, 19 warnings, exit 0. Bar warnings are pre-existing classes (unsigned, >=0.5 resolver-grammar notice shared with activity). No sibling linter-drift failures under the newer SDK linter (activity/file-manager/git-panel/palette/wheel all pass).
• bun test: 161 pass, 0 fail.
• just check: exit 0 (fmt-check, lint, type-check, test, registry-validate, registry-check, app-build).
• Managed commit hooks passed (commitlint).

Security/privacy impact

None. Registry-data addition plus one reviewed submodule-pin bump; no code, workflow, config, or secret changes. Both pins are mainline tips; the manifest hash binds the bar manifest bytes.

Residual risks and follow-ups (not in this change)

• Shared-checkout dirty state (TODO.md beacon lines, local submodule bumps, untracked registry-pins.toml and nested clones) left untouched for owning agents/commander; this PR was built on a clean isolated worktree instead.
• plugins/statusline stray-submodule warning remains (follow-up owned by commander per chore(registry): remove superseded statusline entry #69).
• Pre-existing validator gap (out of scope, owned by CTX-0026 track): pin reachability always reports "no recorded pin" because readSubmodulePins runs non-recursive git ls-tree HEAD plugins; mainline proof above was done manually via ls-remote.
• No unrelated plugin pointers changed (sdk bump is the reviewer-directed fix; sibling pins untouched at their committed revisions).

Merge note

Do NOT merge here. Commander merges after CI and independent re-review.