fix(marketplace): release builds ship the mock catalog and mock installs write to the real extensions folder #1568

Problem

MarketplaceRepository.instance defaults to MockMarketplaceRepository() (lib/core/market/marketplace_repository.dart:27), and HttpMarketplaceRepository is constructed nowhere in lib/ (only in tests). So the release app's Extension Manager shows and installs a hard-coded demo catalog:

• 6 fake listings (ClickHouse / Redis / MongoDB / "postgres-exporter" drivers, two themes), some tagged official, with cdn.queryahub.com URLs and fake checksums (e3b0c442...b855 is the SHA-256 of an empty string). Nothing in the UI says the catalog is a demo; the only badge is "Preview" for drivers.
• Search and "download" are Future.delayed loops that fake progress.
• Install writes to the user's real extensions folder (ExtensionPaths.extensionsDirectory()): a manifest-only directory, and for themes a generated theme.json. These persist across updates and show as installed extensions.
• Bug in the generated theme (:278): the template is a non-raw '''...''' string containing "\${manifest.name}". \$ escapes the interpolation, so every generic mock theme is literally named ${manifest.name}.

CHANGELOG lists "Planned 0.5.0 — live Marketplace download and install", so the mock is intentional, but it should not reach users this way.

Fix

• Until the live API ships: in release builds either hide the Marketplace tab (keep Install from file), or show an explicit "Demo catalog, nothing is downloaded" banner and make Install a no-op that does not touch the extensions folder.
• Choose the repository by build/config (kDebugMode or a dart-define with the API base URL) in one place at startup; move MockMarketplaceRepository and its fixtures under test/ or a dev-only file.
• Fix the \${manifest.name} escape (or generate the JSON with jsonEncode, not a template string).
• Relates to fix(extensions): manifest id is not validated and is used as a path with recursive delete (path traversal) #1560 / fix(extensions): a failed upgrade deletes the working extension; local and marketplace installs differ #1562 (install path) and the Beta channel epic epic(release): Beta channel: pre-releases that Stable users never see, promoted to stable #1499 (live marketplace may ship to Beta first).