Style: refresh public brand assets

[ivory-code]

Summary

• Refresh the English and Korean README covers and canonical skill icon.
• Add dedicated light and dark OpenAI plugin and composer icons plus a GitHub social card.
• Keep plugin submission guidance aligned with independent npm, GitHub, and directory release channels.

Fixes #222

Behavioral Contract

No runtime QA behavior change. Plugin submission validation now rejects missing or incorrectly sized listing assets, and repository documentation no longer hard-codes a stale approved directory version.

Evidence

• Issue Docs: prevent the published plugin version from drifting #222 captures the directory-version drift.
• Production asset dimensions are covered by test/contributor-workflow.test.mjs.
• plugin/submission.json declares all four OpenAI listing image slots.
• The npm dry run includes the README covers, social card, skill icon, and plugin upload images.

Checks

• Focused regression test
• pnpm test
• pnpm bench:ci for inference, routing, trace, or output
• pnpm bench:execution for E2E compiler or execution fixtures
• pnpm scan for scanner, security, or repository policy
• pnpm plugin:check and pnpm plugin:smoke for plugin changes
• Documentation links and commands verified

Public OSS Check

• No private repository, source, path, customer data, credential, or internal smoke output is included.
• Shared inference has unrelated positive and negative coverage, or this is not applicable.
• User-facing commands and claims match actual behavior.

Review Notes

pnpm bench:ci, pnpm bench:execution, and pnpm scan are N/A because this change does not modify inference, E2E execution, scanner behavior, or repository policy. GitHub social preview still requires the maintainer to upload docs/assets/qamap-social-card.png in repository settings.