catalog: icebox / later (bucket C) #33

Icebox for the profile catalog — the "later / nice-to-have" bucket (C) from the design/security review on #25. Not scheduled; promote items to their own issue when picked up.

• config migrate — guided monolithic → profiles.d/ conversion, with preview + backup (M). Depends on catalog: per-file config (profiles.d/) alongside the monolithic file #28.
• Project-local config — per-directory profiles; precedence flag > env > project > user-active (M).
• Signed/attested remote index — transparency for the catalog distribution path once remote refresh (catalog: lazy remote-refresh of the catalog index (keep bundled fallback) #27) exists (L).
• Periodic re-validation job — detect dead specs and domain-expiry/IP-change hijacks (pin resolved IP at merge, re-check on a schedule) (M).
• Publisher namespacing — publisher/name scoping to deter typosquatting as the catalog grows (L).
• Normalize/cache validated specs to JSON — shrink the YAML attack surface and make AI routing repeatable (M).
• catalog trust/untrust policy commands — Homebrew item-vs-source trust model, if the ecosystem gets large (M).
• SSRF residual — close the intermediate-redirect-hop gap with a pinned-IP transport (validator checks initial + final host today) (S/M).
• Spec-content injection scan — scan fetched spec info/summary/path descriptions for prompt-injection, not just the profile description (M).

Source: 3-round external review (architecture → adversarial security → prioritized roadmap).