feat: Release Radar plugin + waveflow:ui/v1 plugin UI surface

[InstaZDLL]

Goal

Release Radar — surface new & upcoming releases from the artists already in your library, Spotify-style. To be built from scratch as a clean plugin; the WIP attempt (#312) is closed in favour of this.

Why a rebuild

#312 landed the feature and the plugin-UI plumbing together as a WIP. Rather than untangle it, we redo it cleanly: a small, well-scoped ui-world plugin surface in the core, and the Release Radar itself as a separate plugin in the plugins repo — consistent with how Web Radio and Apple Motion Artwork are shipped.

Part 1 — waveflow:ui/v1 plugin world (this repo)

A UI-world lets a plugin render its own view inside WaveFlow without shipping React:

• JSON view descriptor — the plugin returns a declarative view (sections, cards, lists, images, buttons); a generic React renderer in the app draws it. No arbitrary DOM/JS from the guest.
• User actions — the renderer sends typed action events (button click, item open) back to the plugin; the plugin can update its content live (re-emit a descriptor).
• Sidebar entry — a UI plugin can register a navigable entry (icon + label) in the sidebar.
• New permission-gated host import library.read_artists — a redacted read (artist names / ids only, not a full library dump), permission-gated + surfaced in the plugin's "Can reach / uses" chips like the existing capabilities. Honours offline::is_offline() where it fetches.

Design constraints: reuse the existing manifest permission-gate model (plugins guide); the renderer must be safe by construction (declarative descriptor, no raw HTML); keep the guest read-only against the library.

Part 2 — Release Radar plugin (separate repo, waveflow-plugins)

• Reads the library's artists via the gated import, queries MusicBrainz + Cover Art Archive for recent / upcoming releases, and renders them through the UI descriptor (grid of release cards with cover, title, date, artist).
• Explicitly out of scope (as in WIP: add release radar plugin #312): no YouTube downloading, no audio extraction, no hidden playback. Release cards open external search / listen links only.
• Permission-gated network (MusicBrainz + Cover Art Archive hosts allowlisted in its manifest), offline-aware.

Acceptance sketch

• A UI plugin can declare the ui world + library.read_artists, register a sidebar entry, render a descriptor, and handle actions + live updates.
• Release Radar installs from the store, lists new releases for the library's artists, and opens external links — nothing more.
• Fully covered by plugin runtime tests (build_linker, the redacted read, descriptor round-trip).

Related

• Builds on the plugin SDK (RFC-002, plugins guide).
• Supersedes WIP: add release radar plugin #312 (closed).