release: contract review team 0.1.18 (#151)

## Why
Publish the reviewed contract review team fix that was validated by a
fresh final18 real run. The prior run correctly fail-closed when
reporter artifacts escaped the lead case root and clauses.yaml was not
parseable.

## Changes
- bump marketplace entry/catalog to team 0.1.18
- point source/provenance/governance refs to merged team commit
6aa93bf11a6e37cc9d0444e3335ba953bee0a61f
- expose lead 1.0.10, clause 1.0.5, reporter 1.0.4 member versions
- retain legal disclaimer and source-pointer-only distribution

## Validation
- catalog validator exit 0
- i18n validator exit 0
- targeted JSON/ref assertions
- git diff --check

schemas/market-team-entry.client.schema.json

@@ -358,6 +358,12 @@
               "pattern": "^https://[^\\s/?#@]+/[^\\s?#]+$",
               "description": "不含凭据、查询或片段的 HTTPS Git 仓库 URL；安装另经过远程安全策略。"
             },
+            "repoBranch": {
+              "type": "string",
+              "pattern": "^(?!-)[^\\s]+$",
+              "description": "团队 Git 仓库分支名称；默认 main。安装与更新均按该分支解析，并仍以完整 ref 做不可变校验。",
+              "default": "main"
+            },
             "ref": {
               "type": "string",
               "pattern": "^[0-9a-f]{40}$",