Publish kars plugins to their ecosystems (OpenClaw plugin, Headlamp plugin, lightweight mesh plugin)

Track proper, registry-based publishing of the three kars plugins. Today they are **bundled** into the CLI npm package / sandbox image so `kars dev --release` works out-of-the-box, but each should also be published to its native ecosystem so third parties can consume them independently.

## 1. Official OpenClaw kars plugin
The kars OpenClaw plugin (`runtimes/openclaw`, mesh + governance integration). Publish to the OpenClaw plugin ecosystem / npm so any OpenClaw user can add kars governance + E2E mesh without the full kars stack.

## 2. Headlamp plugin
The kars Headlamp CRD-view plugin (`tools/headlamp-plugin`). Publish per the Headlamp plugin publishing flow → (Artifact Hub package + plugin catalog), so it installs via Headlamp's plugin manager rather than a side-loaded ConfigMap.
- Currently: prebuilt `dist/main.js` is bundled into the CLI package and side-loaded into the kind cluster's Headlamp.

## 3. Lightweight mesh plugin (runtime-agnostic)
A minimal AGT-mesh client plugin that works for **any** OpenClaw-compatible runtime — including **nemoclaw**. Decouple the Signal/AGT mesh transport from the kars-specific bits so it's a drop-in for other agent runtimes. Stretch goal: validate it against nemoclaw.

## For now
Everything is **bundled** (CLI npm package + sandbox image) so `kars dev --release` / `kars up --release` work with no repo checkout. This issue tracks moving to proper per-ecosystem publishing.

Start by reading runtimes/openclaw and tools/headlamp-plugin, then trace how the CLI npm package and sandbox image currently bundle and side-load them. Review the Headlamp publishing flow linked in the issue and identify the registry requirements for each ecosystem. Done means the OpenClaw, Headlamp, and runtime-agnostic mesh plugins are independently publishable, with nemoclaw validation treated as a stretch goal.

Written by the indexing model from the issue text.