List installed marketplace plugins
The installed inventory from the local attribution store, each row enriched with update availability from one registry pass.
For each row the registry’s latest-published-version object gives latest
(its version string, or null when the listing has no published version)
and update_available (latest newer than the installed version). A
per-row not-found — the upstream listing vanished or was suspended — is row
STATE, not a route failure: that row answers latest: null,
update_available: false, missing_upstream: true, so one dead listing
never fails the whole inventory. A transport/garbled-upstream failure still
surfaces as a 502 — serving rows without update availability would be a silent
degrade of the spec’d shape.

