docs(plugins): add safe community listing guidance / 添加安全的社区插件收录指南

[kashifmahi]

Summary

• Add English and Chinese Community Plugins pages with a complete, pinned [[plugins]] adoption example.
• Link the pages from both README navigation bars.
• Position the page as a Reasonix-specific complement to the official MCP Registry.
• Document the MCP trust boundary and require reachable public source plus a versioned release before listing a community server.
• Keep the list empty until an entry satisfies those provenance requirements.

Issue

Closes #7165

Security

• Installing or declaring an MCP server is explicitly documented as a trust decision.
• readOnlyHint and destructiveHint are identified as workflow metadata, not containment against malicious code.
• The example pins the package version and uses npx -y so the first-run prompt cannot block the stdio handshake.

Verification

• git diff --check
• English and Chinese Guide anchors verified
• README and local documentation targets verified
• Synthetic merge tree with the latest main-v2 verified

Cache impact

• Cache-impact: none
• Cache-guard: N/A; documentation only
• System-prompt-review: N/A; no provider-visible prompt, memory prefix, tool schema, or request serialization changes

[SivanCola]

I pushed c71a623 to address the documentation, startup, and provenance findings.

What changed:

• added the matching Chinese page and README navigation entry
• documented the official MCP Registry relationship and the actual MCP trust boundary
• changed the example to a pinned, non-interactive npx -y launch
• required reachable public source and a versioned release for every community listing
• removed reasonix-plugin-git-context from the list because its declared public source repository currently returns 404

The npm 0.1.0 artifact is still published, but it should not be promoted from the official README until users can inspect the corresponding source. Once the repository is publicly reachable, the plugin can be re-added with its complete pinned [[plugins]] configuration.

Verified:

• git diff --check
• English and Chinese Guide anchors and local documentation targets
• synthetic merge tree with the latest main-v2