feat: add ICA metering exporter as first pure-Python plugin

[jonpspri]

Summary

Ports the ICA Metering Exporter from IBM/mcp-context-forge PR #5696 at head commit be937dd5743d0abbdc0ce8886b6be93f95c9d3dc into cpex-plugins as the repository's first pure-Python plugin.

Notable deviations from the source PR

• Replaces gateway-internal request_headers_var access with the CPEX boundary extensions.http.headers.
• Replaces mcpgateway logging with Python standard-library logging so the plugin remains standalone.
• Fixes the source PR's undefined-headers NameError in the persona-header loop. This correction is worth feeding back upstream to IBM/mcp-context-forge.

Design decisions

• Extends the plugin catalog to discover and validate both Rust and pure-Python packages while preserving aggregate compatibility fields.
• Splits CI selection by implementation language so Python and Rust plugins run only their appropriate toolchains.
• Adds wrong-language release guards so Python tags cannot enter Rust packaging and Rust tags cannot enter Python packaging.
• Emits only trace-gated, non-sensitive OpenTelemetry operational metadata. The trace ID is an input gate and is never returned; tokens, headers, payloads, caller attribution, arguments, and output are excluded.

Test evidence

The complete local validation sequence is recorded in .omo/evidence/task-*.txt summaries (local execution evidence, intentionally not committed):

• Catalog and wheel-helper suites: 146 passed, 3 skipped.
• ICA Metering Exporter: 77 unit tests passed and 12 plugin-framework integration tests passed; Ruff, mypy, wheel, and sdist checks also passed.
• Rate limiter regression: 84 Rust tests passed and 101 integration tests passed, 17 skipped; format, Clippy, build, benchmark compile, and wheel-install checks passed.
• detect-secrets scan/audit gates: green.
• DCO gates: green for all seven branch commits.

Gateway capability and registration

Gateway registration must grant the plugin the read_headers capability for caller attribution through extensions.http.headers; without it, the gateway strips inbound headers.

Gateway-side registration in mcp-context-forge/plugins/config.yaml is intentionally out of scope for this cpex-plugins pull request.

[lucarlig]

LGTM

A few non-blocking follow-ups:

• Parse the gateway’s actual ToolResult shape (_meta and content) so token counts and error messages aren’t dropped.
• Reject duplicate plugin slugs across the Rust and Python roots.
• Add capabilities: [read_headers] to the README configuration example.