## Summary
Publish transparent portraits for both marketplace teams and all 11
roster members. Team cards use the supervisor portrait; a separate
`member-avatars.v1.json` sidecar supplies member images without changing
the strict `entry.json` member contract accepted by older clients. The
two catalog pointers now reference the merged team releases and their
updated member locks.
为市场中的两个团队和全部 11 位成员发布透明人像。团队卡片复用组长形象，成员图片由独立 sidecar
提供，旧客户端仍可读取原有团队条目。团队指针更新至已合并的团队版本与成员锁文件。
## Validation
- Catalog metadata validation: 0 errors (123 existing warnings)
- i18n validation: 0 errors (123 existing warnings)
- Translation freshness: passed
- Image assets: all 11 member portraits and 2 team portraits are
transparent WebP files
## Why
Publish the reviewed contract review team fix that was validated by a
fresh final18 real run. The prior run correctly fail-closed when
reporter artifacts escaped the lead case root and clauses.yaml was not
parseable.
## Changes
- bump marketplace entry/catalog to team 0.1.18
- point source/provenance/governance refs to merged team commit
6aa93bf11a6e37cc9d0444e3335ba953bee0a61f
- expose lead 1.0.10, clause 1.0.5, reporter 1.0.4 member versions
- retain legal disclaimer and source-pointer-only distribution
## Validation
- catalog validator exit 0
- i18n validator exit 0
- targeted JSON/ref assertions
- git diff --check
## Why
The contract review team already has a reproducible public Git source,
but its market pointer is still listing-only and uses the legacy
display-only shape. The current DesireCore client contract requires
explicit members, capabilities, privacy, an immutable source ref, and
installability evidence.
## What changed
- publish the contract review team as an installable,
source-pointer-only team entry;
- add the six-member roster, capability boundaries, privacy notice, and
update date;
- record review and license evidence in the catalog sidecar;
- keep the legacy team-entry schema branch while adding the current
client contract, so existing public pointers remain valid during
migration.
The source remains a public HTTPS Git pointer locked to commit
`73cd87a9901cc548871927e9d5dbec8e4cc6c2b1`. The team output is
supporting review material, not legal advice, and still requires
qualified human review.
## Validation
- `uv run scripts/catalog/validate_catalog_metadata.py --json` — 0
errors, 129 existing warnings
- `uv run scripts/catalog/test_validate_catalog_metadata.py` — 47 passed
- `uv run scripts/catalog/test_collection_generator.py` — 4 passed
- `uv run scripts/i18n/validate-i18n.py` — no errors; existing catalog
freshness warnings remain
- public-tree sensitive-pattern scan — zero matches
