feat: publish the Mini App contract with an example package and CI checks

[MyPrototypeWhat]

What changed

Contributors — most of them working with AI coding agents — had no way to learn the Mini App package contract without access to the desktop app. This branch puts the contract in the repository and gates pull requests on it.

• AGENTS.md: the entry point coding agents load automatically — steps, hard rules, review policy, navigation.
• docs/package-contract.md, docs/runtime.md, docs/security.md: layout, the three manifests, portable paths and limits, the Node runtime contract, and the security rules. Each states the MiniMax Code version it was verified against.
• examples/hello-miniapp/: the smallest valid package, copyable as a starting point. Its README doubles as the template for the two headings the check looks for.
• npm run check: a zero-dependency validator (scripts/validate.mjs) plus its tests (node --test, 55 cases). It checks manifest field sets, patterns, enums and limits; portable paths and package size; node_modules; the Node entry's start export and stdout use; README headings (warning only); and, repository-wide, plugin-ID uniqueness and root README links. Plugin capabilities (Skills, MCP servers, hooks, host bindings, MCP endpoints, Connector access) are validated for shape only; MiniMax Code validates their contents at install time.
• .github/workflows/ci.yml: runs npm run check on every pull request and push to main.
• CONTRIBUTING*.md / README*.md: point at the example, the docs, and the check. The MiniApps tables and the two existing community packages are untouched.

Commits f9ab13e and 3755895 cancel each other out (an experiment with stricter checks and its revert); a squash merge hides them.

Validation

• npm ci && npm run check on the branch head: examples/hello-miniapp OK; plugins/amszuidas/mcode-token-usage-board and plugins/yanhy2000/mcode-usage-monitor 0 errors (two README-heading warnings each, by design); repository OK; 55/55 tests; CI green.
• The package from PR Add Model Manager mini app by ocoomber #4 (openrouter-model-manager, a package that runs on a real host) validated separately: 0 errors, 1 warning.
• Example runtime: start(context) → GET /dashboard 200 → dispose() frees the port; nothing written to stdout.
• Example installed into a real MiniMax Code (3.0.73, macOS) and opened through the Agent: page rendered.

Not covered

• No runtime smoke test in CI (a follow-up).
• README headings are a warning, not an error, until the existing packages adopt them.
• The validator's constants mirror the host's reader by hand; the Verified against markers and header comments in the host repository are the sync mechanism.