feat(appstore): view detail command + catalogue v2 metadata

[Alexgodoroja]

What

Adds pilotctl appstore view <id> — a detail page for app-store apps, the way a human app store shows one. Today the catalogue only carries id, version, a one-line description, and the bundle pin; there is nowhere to see a structured description, vendor, changelog, size, source URL, or methods before installing. This adds that.

view merges three provenance-labelled bands:

• catalogue — the index teaser (publisher-attested, sha-anchored)
• metadata — a sha-pinned per-app detail doc (full description, changelog, vendor, screenshots…)
• local-manifest — verified install facts when installed (integrity, real on-disk size, granted permissions, methods)

It works whether or not the app is installed, and whether or not it is in the catalogue (a sideloaded app renders from local facts alone). --json emits the merged report; --all-changelog shows full history. The publisher copy and the verified install facts are kept visually distinct so they are never conflated.

Catalogue schema v2

The catalogue index gains optional teaser fields (display_name, vendor, categories, bundle_size, source_url, license) and a metadata_url + metadata_sha256 pin to a per-app catalogue/apps/<id>/metadata.json detail document. The detail doc is fetched lazily by view and verified against the pin exactly the way bundle tarballs are — the same CDN-substitution defence.

The detail schema reserves a reviews slot for a future signed reviews service; it is parsed but never written here.

Backward compatibility

• v1 catalogues still load unchanged — loadCatalogue now accepts versions 1 and 2; all v2 fields are omitempty.
• An older pilotctl ignores the v2 fields — the bump is backward and forward compatible by construction.
• No change to install, status, list, or any existing output shape. The catalogue listing gains a teaser line and a view: hint only when v2 fields are present.

Worked example

catalogue.json is migrated to v2 with real teaser data + metadata pins, and catalogue/apps/{io.pilot.cosift,io.pilot.wallet}/metadata.json are populated from the real manifests, repo licenses, bundle sizes, and release notes.

Tests

• loadCatalogue accepts v1/v2, rejects v3; v1 entries decode with empty v2 fields
• loadAppMetadata sha-pin verification (correct / mismatch / unpinned / id-mismatch)
• buildAppViewReport band-merge precedence (detail overrides teaser; real on-disk size wins; manifest-method fallback; sideloaded path)
• cmdAppStoreView JSON output for the catalogue+metadata+installed case
• scripts/smoke-test-appstore.sh extended to stage a v2 catalogue + detail doc and assert view end-to-end (catalogue teaser + sha-verified detail + installed manifest)

go test ./cmd/pilotctl/, go vet, gofmt -l, and go build ./... all clean.

How to QA / test before deploy

1. Build: go build -o /tmp/pilotctl ./cmd/pilotctl
2. Stage the new catalogue locally (rewrite metadata_url to file:// so it resolves before merge) and run appstore catalogue + appstore view io.pilot.cosift.
3. Full live e2e: scripts/smoke-test-appstore.sh (needs the wallet repo at ../wallet).

Detailed QA steps are in the PR thread.