[xscriptor]

Summary

• Adds the root index.json addon catalog for xfetch extension search, with 5 entries sorted by name.
• Adds scripts/generate_catalog.py, a standard-library-only deterministic generator with --check stale-catalog detection.
• Applies the pending semver-compatible dependency updates.

Catalog

• Native extensions use runtime: "native" with metadata from Cargo.toml.
• WebAssembly extensions use runtime: "wasm" with metadata and capabilities from xfetch-extension.json; guest_runtime records core or component.
• Crate versions remain 0.2.0; no extension code or manifests changed.

Dependency updates

• serde_json 1.0.151 -> 1.0.154
• syn 3.0.3 -> 3.0.9
• unicode-ident 1.0.24 -> 1.0.27
• Security-audit workflow: actions/checkout 7.0.1 and the pinned dtolnay/rust-toolchain commit.

Verification

• python3 scripts/generate_catalog.py --check
• python3 -m json.tool index.json >/dev/null
• cargo fmt --all --check
• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• cargo audit --deny warnings: 15 crate dependencies, 0 vulnerabilities, 0 warnings
• cargo update --dry-run --verbose: 0 packages remaining

No merge.