feat: add ICA metering exporter as first pure-Python plugin

[jonpspri]

Summary

Ports the ICA Metering Exporter from IBM/mcp-context-forge PR #5696 at head commit be937dd5743d0abbdc0ce8886b6be93f95c9d3dc into cpex-plugins as the repository's first pure-Python plugin.

Notable deviations from the source PR

• Replaces gateway-internal request_headers_var access with the CPEX boundary extensions.http.headers.
• Replaces mcpgateway logging with Python standard-library logging so the plugin remains standalone.
• Fixes the source PR's undefined-headers NameError in the persona-header loop. This correction is worth feeding back upstream to IBM/mcp-context-forge.

Design decisions

• Extends the plugin catalog to discover and validate both Rust and pure-Python packages while preserving aggregate compatibility fields.
• Splits CI selection by implementation language so Python and Rust plugins run only their appropriate toolchains.
• Adds wrong-language release guards so Python tags cannot enter Rust packaging and Rust tags cannot enter Python packaging.
• Emits only trace-gated, non-sensitive OpenTelemetry operational metadata. The trace ID is an input gate and is never returned; tokens, headers, payloads, caller attribution, arguments, and output are excluded.

Test evidence

The complete local validation sequence is recorded in .omo/evidence/task-*.txt summaries (local execution evidence, intentionally not committed):

• Catalog and wheel-helper suites: 146 passed, 3 skipped.
• ICA Metering Exporter: 77 unit tests passed and 12 plugin-framework integration tests passed; Ruff, mypy, wheel, and sdist checks also passed.
• Rate limiter regression: 84 Rust tests passed and 101 integration tests passed, 17 skipped; format, Clippy, build, benchmark compile, and wheel-install checks passed.
• detect-secrets scan/audit gates: green.
• DCO gates: green for all seven branch commits.

Gateway capability and registration

Gateway registration must grant the plugin the read_headers capability for caller attribution through extensions.http.headers; without it, the gateway strips inbound headers.

Gateway-side registration in mcp-context-forge/plugins/config.yaml is intentionally out of scope for this cpex-plugins pull request.

[lucarlig]

LGTM

A few non-blocking follow-ups:

• Parse the gateway’s actual ToolResult shape (_meta and content) so token counts and error messages aren’t dropped.
• Reject duplicate plugin slugs across the Rust and Python roots.
• Add capabilities: [read_headers] to the README configuration example.

[jonpspri]

Thanks for the review, Luca. I've pushed three DCO-signed commits addressing each of the three summary items (there were no resolvable inline threads to mark):

1. Parse gateway ToolResult payloads — 8c50a82
metering.py now reads the error text from result.content[...].text and token metadata from both _meta and meta. Covered by two new unit tests.

2. Reject duplicate plugin slugs across managed roots — 9e93c9a
tools/plugin_catalog.py raises CatalogError when the same slug exists in both plugins/rust/python-package/ and plugins/python/. Covered by a new unit test.

3. README capability example — 967e0b7
   Added capabilities: [read_headers] to the sample plugin config in README.md.

Verification:

• ICA metering exporter make ci: Ruff, strict mypy, 79 unit tests, build, 12 integration tests passed.
• Catalog suite: 133 passed, 3 skipped.
• Real catalog validation and language-split selection passed.
• Direct ToolResult hands-on QA passed.
• README fenced YAML parsed and capability placement verified.
• git diff --check passed.

Branch feat/ica-metering-exporter-plugin pushed normally; local, remote, and PR head all now at 967e0b7.