[cinderzhan]

Summary

• Align the submission contract with the current Desktop host: repository owner/repo is the canonical workbench identity. New YAML omits workbenchId; published catalog still derives the compatibility field for older consumers and preserves legacyWorkbenchIds migration.
• Correct the catalog example, schema, validation, submission guide, and package-contract explanation.
• Replace the workflow_run/commit-to-PR lookup with a pull_request_target probe that checks out trusted main, validates the exact PR number and head SHA, and only reads candidate YAML from the verified fork repository. Missing or stale PRs fail; the job itself is the PR check.

Verification

• npm run check (57 tests passed)
• git diff --check

Rollout note

The old trusted gate on main cannot validate this workflow change before merge. After merge, exercise a fresh ordinary fork PR and inspect the Trusted catalog probe log before treating its status as evidence. Merge this contract before publishing the revised website guides.