Add Sprites plugin

[aezell]

What this PR does

Adds the official Fly.io Sprites plugin for Grok Build. The plugin connects Grok to the hosted Sprites MCP server and supplies skills for isolated remote compute, first-run authentication, safe command execution, services, checkpoints, network policy, and smoke testing.

• Plugin name: sprites
• Type: remote source
• Source URL + pinned SHA: https://github.com/superfly/sprites-grok-plugin.git at a696ac338d86529c45f959b8b002e456330d349a
• Homepage: https://sprites.dev

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (or I've explained why not below).

The plugin is published by Fly.io under the official superfly GitHub organization.

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set; local plugins include README.md + .grok-plugin/plugin.json.
• License is stated.

Security

• No curl | bash, install-time remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege.
• Network endpoints this plugin calls (and why): https://sprites.dev/mcp, the Fly.io-operated hosted MCP control plane for Sprites. OAuth discovery and consent remain on the sprites.dev host.
• Credentials/permissions it requires (and why): browser OAuth with the Sprites sprites:read and sprites:write scopes. The recommended/default connector token is restricted by a non-empty Sprite name prefix and a creation cap. Full organization access is optional and explicitly warned about in the README and skill.

Notes for reviewers

• The repository contains no local server executable, install script, hooks, postinstall behavior, or telemetry. The MCP server is hosted and operated by Fly.io.
• exec is an intentional product capability for user-requested commands inside hardware-isolated remote Sprites. It never executes commands on the Grok user's local machine.
• Destructive operations such as destroy, checkpoint restore, and network-policy changes are marked destructive by the MCP server; the bundled skill additionally requires explicit user intent or confirmation.
• The file-writing reference documents base64 as a transparent transport encoding for user/generated file content through the MCP exec schema. The plugin contains no encoded or obfuscated payload blobs.
• Local verification found version 0.2.0, three skills (sprites, sprites-status, sprites-smoke), and one hosted MCP server (sprites).