Add the storeconnect plugin

[Harrymato]

What this PR does

Adds StoreConnect — a Salesforce-native commerce, POS and CMS platform — as a remote-source plugin. 13 skills, 3 slash commands and 5 specialist agents covering storefront Liquid templates, forms and reloadable components, catalog and content, point of sale, and the StoreConnect object model in Salesforce.

• Plugin name: storeconnect
• Type: remote source
• Source URL + pinned SHA: https://github.com/GetStoreConnect/ai.git at 7be65db020ada44c1780a34501264eed6ac19e80, with source.path = providers/grok/storeconnect
• Homepage: https://github.com/GetStoreConnect/ai

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (or I've explained why not below).

GetStoreConnect is the StoreConnect organization; GetStoreConnect/ai is our public AI distribution repository. MIT licensed.

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set; local plugins include README.md + .grok-plugin/plugin.json.
• License is stated.

The regenerated index records version 0.9.2 and components skills: 13, commands: 3, agents: 5.

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege.

The package is markdown only — skills, commands and agent prompts. It ships no hooks, no scripts, no .mcp.json and no .lsp.json, so the generated index contains no mcpServers entry.

• Network endpoints this plugin calls (and why): none at install or load time. At runtime a store administrator may separately configure an MCP connection to their own store's /mcp endpoint on their own domain. No endpoint is committed anywhere in our repository, because every StoreConnect store serves its own — a validator in that repo fails the build if a resolved MCP configuration appears, and the only committed examples use store.example.com.
• Credentials/permissions it requires (and why): none. Installing connects nothing and includes no credentials. The skills instruct agents to use the host's native sign-in flow and explicitly forbid putting tokens in files, prompts or chat messages.

Notes for reviewers

• Monorepo layout, hence source.path. GetStoreConnect/ai generates eight provider packages from one canonical source so they cannot drift, so the Grok package is a subdirectory rather than the repo root. Same arrangement as stripe/ai and tinyfish-io/... in the current catalog. Pointing at the repo root would index 13 skills and miss the manifest, commands and agents — I checked with plugin_catalog.py before choosing this.
• Directory layout matches the scanner, not a guess. Skills, commands and agents sit at the plugin root because that is what scan_skills and scan_markdown_dir read; the manifest declares no component paths, following external_plugins/neon.
• Keywords and domains are brand-scoped, per the CTA warning in CONTRIBUTING — storeconnect, storeconnect theme, storeconnect pos, and our own hosts only. Nothing like commerce, salesforce or pos on its own, which would misfire the plugin CTA on unrelated requests.
• The plugin is write-capable against a connected store, and the procedures that do so are deliberate: staged changes, an explicit human approval gate, and a live verification afterwards. sc-publish will not infer or reuse approval.