Add supabase-battle-tested plugin

[YoungAlgy]

What this PR does

• Plugin name: supabase-battle-tested
• Type: remote source
• Source URL + pinned SHA (remote): https://github.com/YoungAlgy/supabase-battle-tested.git @ c8f08e7621ba58bcacd393c01e6eb74068152498
• Homepage: https://github.com/YoungAlgy/supabase-battle-tested

A single skill (supabase-production-patterns) covering four production Supabase/Postgres patterns learned from real incidents, not paraphrased docs: the generated-column write trap (Postgres error 428C9), migrations-vs-live-DB schema drift and how to get ground truth, a manual SECURITY DEFINER audit methodology including a service_role-vs-auth.uid() gate trap, and the (select auth.uid()) RLS performance fix for the auth_rls_initplan advisory.

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (or I've explained why not below).

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set; local plugins include README.md + .grok-plugin/plugin.json.
• License is stated.

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege.
• Network endpoints this plugin calls (and why): none. It's a static markdown skill (guidance only), no scripts, no hooks, no MCP server.
• Credentials/permissions it requires (and why): none.

Notes for reviewers

Personal-account source, not an official org, because this isn't a branded product plugin — it's original written guidance distilled from my own hands-on Supabase production experience (not Supabase's docs, not affiliated with Supabase Inc.). No impersonation intended; description and repo name make the "community lessons" framing explicit.