Integrate validated catalog loading (T-201)

testdata/README.md

@@ -5,3 +5,4 @@
 - 不放生产私钥、真实注册码、真实机器标识或真实下载地址。
 - 测试若需要签名,使用测试代码中明确标注的专用测试密钥。
 - 恶意样例用于证明解析器和安全边界会拒绝输入,不得被发布流程消费。
+- `catalog/manifest-valid-payload.json` 同时作为 manifest v1 强类型解析与目标过滤的公开虚构样例;包哈希与签名只保证格式合法,不对应真实下载物。

testdata/catalog/manifest-tampered-payload.json

@@ -11,7 +11,9 @@
       "version": "9.9.9",
       "channel": "stable",
       "status": "active",
+      "category": "开发工具",
       "tags": ["工具", "JSON"],
+      "icon": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
       "min_os": "windows-10",
       "architectures": ["amd64"],
       "entry_exe": "JsonParser.exe",
@@ -20,8 +22,8 @@
         "amd64": {
           "url": "https://download.invalid/forged.zip",
           "size": 42,
-          "sha256": "forged-sha256-placeholder",
-          "signature": "forged-package-signature-placeholder"
+          "sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
         }
       }
     }

testdata/catalog/manifest-valid-payload.json

@@ -11,7 +11,11 @@
       "version": "1.2.0",
       "channel": "stable",
       "status": "active",
+      "category": "开发工具",
       "tags": ["工具", "JSON"],
+      "icon": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "homepage": "https://example.invalid/json-parser",
+      "tutorial": "https://example.invalid/json-parser/tutorial",
       "min_os": "windows-10",
       "architectures": ["amd64"],
       "entry_exe": "JsonParser.exe",
@@ -20,8 +24,8 @@
         "amd64": {
           "url": "https://download.invalid/json-parser.zip",
           "size": 42,
-          "sha256": "test-sha256-placeholder",
-          "signature": "test-package-signature-placeholder"
+          "sha256": "0000000000000000000000000000000000000000000000000000000000000000",
+          "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
         }
       }
     }