feat: complete Codex plugin metadata

[davidmytton]

The Codex manifest was missing category, capabilities, and starter prompts required by the plugin-creator validator. Add those fields, classify the plugin as Security in both the manifest and marketplace catalog, and include Arcjet's terms URL plus composer and light/dark logo assets copied from arcjet/arcjet.

Preserves the existing repository layout and the Cursor, Claude Code, and Open Plugins manifests.

Validation: the plugin-creator validator, bash scripts/validate.sh, and git diff --check passed. Local formatting validation was unavailable because dprint is not installed.

[arcjet-review]

Arcjet Review — 🟢 Low Risk

Decision: Checked

Rationale: Metadata-only PR: adds required Codex plugin manifest fields (category, capabilities, defaultPrompt, termsOfServiceURL, composerIcon, logoDark), updates the marketplace category to Security, swaps the logo reference from logo.svg to icon.png, and adds two icon PNG assets. No executable code, no auth/DB/CI/dependency changes, no secrets. Security review checklist finds nothing applicable.

Summary of Changes

Completes the Codex plugin manifest with category, capabilities, starter prompts, terms URL, composer/light/dark logo assets, and reclassifies the plugin as Security in the marketplace catalog.

Notes

The AI assessed this PR as approvable, but the trust level (1) does not allow auto-approval. A human reviewer must approve this PR.

_{Review: ed3b7a7b | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}