[xscriptor]

Summary

• Adds the root index.json addon catalog for xfetch effects search, with 4 entries sorted by name.
• Adds scripts/generate_catalog.py, a standard-library-only deterministic generator with --check stale-catalog detection.
• Applies the pending semver-compatible dependency updates.

Catalog

• Native effects use runtime: "native" with metadata from Cargo.toml.
• WebAssembly effects use runtime: "wasm" with metadata and capabilities from xfetch-effect.json; guest_runtime records core or component.
• effects-lib is excluded because it is a shared library, not an installable effect.
• Crate versions remain 0.2.0; no effect code or manifests changed.

Dependency updates

• serde_json 1.0.151 -> 1.0.154
• syn 3.0.3 -> 3.0.9
• unicode-ident 1.0.24 -> 1.0.27
• Security-audit workflow: actions/checkout 7.0.1 and the pinned dtolnay/rust-toolchain commit.

Verification

• python3 scripts/generate_catalog.py --check
• python3 -m json.tool index.json >/dev/null
• cargo fmt --all --check
• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• cargo audit --deny warnings: 16 crate dependencies, 0 vulnerabilities, 0 warnings
• cargo update --dry-run --verbose: 0 packages remaining

No merge.