chore: privacy, support and docs links for the plugin listing

[MarkAlex1234]

Summary

Fills the 3 empty links the Claude directory listing shows:

 claude-plugin/.claude-plugin/plugin.json
+  "documentationUrl": ".../go-tokenless#readme"
+  "supportUrl":       ".../go-tokenless/issues"
+  "privacyPolicyUrl": ".../blob/main/PRIVACY.md"
+PRIVACY.md   no personal data and no telemetry; the only network use is read-only npm registry lookups (--offline turns them off)

Merge danger

Door: two-way

Blast radius: metadata and docs only.

[claude]

Docs and metadata only. I found no blocking issues.

• The PRIVACY.md network claim matches the code. The only fetch is a GET to registry.npmjs.org/<pkg>, and --offline skips it (src/plan.ts:190-197).
• The --read-token option only writes a ${{ secrets.NAME }} reference into the workflow. It never reads the secret value, so "Never accessed: secrets, tokens" holds.
• I did not run the build or tests, and did not verify the plugin.json field names against Anthropic's directory schema.
• The new URLs point at blob/main/PRIVACY.md, which only resolves once this PR is merged.

[claude]

Docs and metadata only. PRIVACY.md matches the code: the only network call is the read-only GET to registry.npmjs.org in src/plan.ts:194. The plugin.json URLs look right. I did not run the build or tests.

One non-blocking note: the privacyPolicyUrl points at blob/main/PRIVACY.md, so it returns 404 until this PR is merged. Submit the directory listing after the merge.