Proposal: add a fail-closed security-hooks plugin to the marketplace

Thanks for curating this marketplace — `aws-dev-toolkit` is a great build-side companion for startups on AWS.

One area a startup hits the moment it touches regulated data (fintech, health) is **guardrails on what the agent does**, not just what it can build. I've published an open-source (Apache-2.0) Claude Code plugin that fills that layer and would fit alongside `aws-dev-toolkit`:

**`fail-closed-security-hooks`** — five hooks wired through a fail-closed telemetry shim:
- **PII/secrets guard** — blocks AWS keys, private keys, JWTs, DB strings, credit cards, and national IDs across 7 jurisdictions (US/UK/JP/KR/SG/EU/AU) before they reach the model
- **Git policy guard** — remote allowlist, force-push prevention, protected branches, destructive-op blocking
- **Tamper-evident audit logger** — HMAC-SHA256 hash-chained JSONL; any edit/delete/reorder breaks the chain (verifier included); optional CloudWatch + SIEM dual-write
- **Token-budget circuit breaker** — per-session backstop for runaway agent loops
- **Fail-closed telemetry shim** — converts silent hook crashes/timeouts into explicit denials

Passes `claude plugin validate --strict`; ships a 76-assertion test suite. Repo: https://github.com/timwukp/claude-code-on-aws-bedrock-best-practices (plugin under `plugin/`).

**Question:** would a security/guardrails plugin be in scope for this marketplace? If so I'm happy to open a PR adding a `plugins/` entry and registering it in `marketplace.json` (source can reference my repo). Thanks!

Confirmez d’abord que le marketplace accepte ce plugin de sécurité/guardrails, puisque l’issue demande s’il entre dans le périmètre. S’il est accepté, examinez marketplace.json et les entrées existantes de plugins/, puis vérifiez le plugin sous plugin/ et sa suite de tests de 76 assertions ; c’est terminé lorsque la source est enregistrée et que la validation du marketplace réussit.

Rédigé par le modèle d'indexation à partir du texte de l'issue.