Add Composer build-and-deploy plugin for desktop preview

[luanvdw]

Overview

Prepare a focused desktop-local Prisma plugin so a user can select Prisma, ask to build and deploy an app, and have the agent handle setup, local verification, and deployment. This is a reviewable local preview; first-time onboarding and public distribution remain gated below.

Changes

• Add the 0.4.0-dev.4 portable plugin under plugins/prisma, with approved Prisma branding and new/existing-app starter prompts. Add an opt-in prisma-preview marketplace under plugins/; preserve the existing root marketplace and installer routes until the complete public bundle and onboarding are ready.
• Pair one authored build-and-deploy workflow with the unchanged Composer 0.21.0 reference. Keep dependency pins, managed browser login, and narrowly verified recovery commands in one supporting reference.
• Add an integrity-pinned packager that preserves authored files and records the complete bundle's hashes, plus regression coverage for repeatability, preservation, and tampering detection.
• Document prior local/live verification, distinguish agent-reported evidence, and record the remaining desktop onboarding acceptance work.

Why

Composer owns its API reference; the plugin owns completing the user journey. This avoids another starter or duplicated API guidance while requiring observable local persistence and live functionality. Browser signup alone cannot establish a connection: the workflow requires CLI completion, authenticated identity, and remote workspace access before provisioning.

Validation

• Local code review found and resolved premature default-marketplace routing and an ignore-rule assertion that skipped tracked files. Follow-up review found no remaining actionable concerns within the local-preview scope.
• Packaging regression test, offline bundle integrity, authored skill-format validation, marketplace target/asset/skill checks, and diff whitespace checks passed. The root marketplace is byte-for-byte unchanged from main. No hosted CI checks are configured in this repository.
• Imported Composer skill SHA-256 remains 67b50e78fbb6cafd00bb99b0e56fe8a49e4a7190219474bf1b9be933f08bbcbb.
• Prior Todo runs verified local restart persistence and live database/API/browser behavior. No new cloud deployment or fresh signup was performed for this PR; evidence and limits are in docs/validation.md.

Before publication

• Release and verify an exact CLI containing auth login --ui-context prisma-plugin (implemented in Add plugin-specific login completion guidance prisma-cli#281; coordinated release PR Bump to version 8.0.0-rc.16 prisma-cli#282 remains unmerged). The reference explicitly blocks using that option with the retained 8.0.0-rc.15 baseline.
• Update the verified pin, refresh the installed preview, and complete human-assisted fresh-user acceptance on macOS. Web/cloud execution is deferred; the existing installed v3 preview is unchanged.
• Include the generated Composer skill, assets, license, and provenance in the chosen public distribution, then complete marketplace submission. These generated files are intentionally ignored in this local-preview PR, so a fresh clone must run the packager before installation.