feat: add locked community package catalog

[tifycloud]

Summary

• expand the AX9000 official catalog to 12,123 records by adding 969 locked kiddin9 community candidates
• expose community source/search filters and clear unreviewed/blocked UI labels
• keep every community candidate fail-closed and out of production build requests
• bind metadata and normalized candidate projection to manifests/community-feeds.lock
• add Pages and backend tamper regression coverage

Safety model

• community Packages.gz is parsed as metadata only
• no community IPK is downloaded or installed by production workflows
• no community source repository is cloned or executed by production workflows
• all 969 community candidates remain unselectable until separately audited/promoted

Verification

• bash tests/test_static.sh
• ./scripts/validate.sh
• independent adversarial review: APPROVE