feat(plugins): add Solana token risk check

[scrumlord8]

What changed

Adds plugins/token-risk-check, a T0 read-only Solana safety preflight for ZeroClaw agents.

The token_risk_check tool accepts a mint address and returns a compact red/amber/green heuristic covering:

• mint and freeze authorities;
• top-1 and top-5 token-account concentration;
• security-relevant Token-2022 extensions;
• optional indexed Solana liquidity.

The implementation keeps the risk parser and policy in a host-testable pure Rust module, with a thin wasm32-wasip2 WIT and wasi:http shim.

Why

Agents need an inexpensive, bounded preflight before discussing or constructing token actions. The plugin gives them a useful first-pass risk signal without adding custody, signing, transaction construction, or arbitrary URL access.

Safety

• Custody tier: T0 Read.
• Manifest permissions are limited to http_client and jailed config_read.
• Tool arguments reject unknown fields and never accept keys, wallets, or URLs.
• Remote JSON is treated as untrusted input and only allowlisted fields are rendered.
• RPC failures fail closed; liquidity-index failures are reported as unknown.
• Collection and output sizes are bounded.
• README includes a threat model and prompt-injection transcript.

Validation

• cargo test --locked — 10 tests passed.
• cargo clippy --all-targets -- -D warnings — passed.
• cargo build --locked --target wasm32-wasip2 --release — passed.
• python3 -m unittest discover -s tools/tests -p 'test_*.py' — 17 tests passed.
• python3 tools/build-registry.py --source-plugins plugins --check-metadata registry.json — passed.
• Loaded and executed the release WASM in ZeroClaw's real Wasmtime plugin host against deterministic local RPC and liquidity fixtures — passed.

Notes

getTokenLargestAccounts reports token accounts rather than deduplicated beneficial owners, so the output explicitly labels concentration as a proxy. Indexed liquidity is optional and coverage-dependent.