Proposal: add a fail-closed security-hooks plugin to the marketplace

Thanks for curating this marketplace — `aws-dev-toolkit` is a great build-side companion for startups on AWS.

One area a startup hits the moment it touches regulated data (fintech, health) is **guardrails on what the agent does**, not just what it can build. I've published an open-source (Apache-2.0) Claude Code plugin that fills that layer and would fit alongside `aws-dev-toolkit`:

**`fail-closed-security-hooks`** — five hooks wired through a fail-closed telemetry shim:
- **PII/secrets guard** — blocks AWS keys, private keys, JWTs, DB strings, credit cards, and national IDs across 7 jurisdictions (US/UK/JP/KR/SG/EU/AU) before they reach the model
- **Git policy guard** — remote allowlist, force-push prevention, protected branches, destructive-op blocking
- **Tamper-evident audit logger** — HMAC-SHA256 hash-chained JSONL; any edit/delete/reorder breaks the chain (verifier included); optional CloudWatch + SIEM dual-write
- **Token-budget circuit breaker** — per-session backstop for runaway agent loops
- **Fail-closed telemetry shim** — converts silent hook crashes/timeouts into explicit denials

Passes `claude plugin validate --strict`; ships a 76-assertion test suite. Repo: https://github.com/timwukp/claude-code-on-aws-bedrock-best-practices (plugin under `plugin/`).

**Question:** would a security/guardrails plugin be in scope for this marketplace? If so I'm happy to open a PR adding a `plugins/` entry and registering it in `marketplace.json` (source can reference my repo). Thanks!

Confirma primero que el marketplace acepta este plugin de seguridad/guardrails, ya que el issue pregunta si está dentro del alcance. Si se acepta, inspecciona marketplace.json y las entradas existentes de plugins/; después revisa el plugin bajo plugin/ y su suite de pruebas de 76 assertions; se considera terminado cuando la fuente está registrada y la validación del marketplace pasa.

Escrito por el modelo de indexación a partir del texto del issue.