catalogue: pin io.telepat.ideon-free publisher (v1.12.3 anchor fix)

v1.12.3's catalogue anchor fail-closes any entry without a publisher pin.
io.telepat.ideon-free was the only unpinned app (the four io.pilot.* are
pinned) → it would be refused on hosts updating to v1.12.3.

Add publisher: ed25519:5cqj+... (== the bundle's store.publisher signing key,
verified) and re-sign catalogue.json. New .sig verifies against the embedded
catalogtrust pubkey.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Alex Godoroja

catalogue/catalogue.json

@@ -117,7 +117,8 @@
       "version": "0.3.1",
       "description": "Free article generation for agents: ideon-free.generate(idea) returns a jobId; ideon-free.poll(jobId) returns the finished markdown article. Thin adapter over Ideon's ideon_write — no payment.",
       "bundle_url": "https://github.com/pilot-protocol/catalog/releases/download/ideon-free-v0.3.1/io.telepat.ideon-free-0.3.1.tar.gz",
-      "bundle_sha256": "dd8e37057f33eadefff6b7ff5fc99130667076ea398c10a154c345fd87dd1ad6"
+      "bundle_sha256": "dd8e37057f33eadefff6b7ff5fc99130667076ea398c10a154c345fd87dd1ad6",
+      "publisher": "ed25519:5cqj+zTVecj8r0YRUShpgFi/g7TxDg1lkDKQzfNyDyc="
     }
   ]
 }

catalogue/catalogue.json.sig

@@ -1 +1 @@
-7bQgHV+ENB1G3zl13+rfyoe8XCwncxEwDcol+Uqq6KjXgnjT6eBGYUJ2yo5F5l1AelylDa6kX8fZQWASCbsOAQ==
+8DN2+0oxrOTH/Z67t6MHvhphJYnMh5xQdIvchyhnyKER4ze5h5rU0HgqIWnxSavuj/ggbBwAPENROapndXkoBg==