Implement registry labeller and wire labels into install flows

[ascorbic]

Goal

The plugin registry needs a labeller so decentralized discovery has a usable trust and moderation layer.

Scope

Implement the reference labeller described by the registry RFC and wire label data into the aggregator and admin install experience.

Acceptance criteria

• A reference labeller can publish verification, warning, and takedown labels.
• Aggregator queries can filter or annotate results using accepted labellers.
• Admin browse/install surfaces label state clearly.
• Install/update policy respects takedown and trust labels.
• Documentation explains the labeller trust model.