[tomdavidson]

Adds plugins/openspec.toml for the OpenSpec CLI, using the standalone release binaries (no Node required).

Verified

• Asset names match the v2.0.0 release: openspec-{linux,darwin}-{x64,arm64}.tar.gz, openspec-linux-{x64,arm64}-musl.tar.gz, openspec-windows-{x64,arm64}.zip, plus a shared SHA256SUMS.
• Tags are vX.Y.Z, so URLs use v{version}.
• Shared checksum file follows the same pattern as tofu.toml.
• No exe-path or archive-prefix: the upstream installer extracts openspec from the archive root, so the default exe name applies.

Not verified

• [install.libc] gnu = "": glibc assets have no suffix and musl assets use -musl. No other plugin in this catalog maps {libc}, and an empty value is untested. CI runs on ubuntu, so the smoke install exercises exactly this case. If it fails, drop [install.libc] and hardcode openspec-linux-{arch}.tar.gz (loses musl).
• Windows: the asset name is confirmed, but the exe location inside the zip is assumed to be the root. CI does not cover Windows.
• musl and macOS are not covered by CI.

Known limits

• Versions before 1.16.0 will 404. Standalone binaries started in 1.15.0, and that release shipped bare binaries rather than archives. Git tags still list the older versions.
• latest can 404 for a few minutes after a new upstream tag, because the release is published before the binaries are attached. This can cause a flaky smoke test.