[Lucas1479]

A package can pass wheel checks while still leaving the user to install and operate its real runtime separately. This makes the installation responsibility explicit before installation: a connector integrates an existing external application/service; a complete plugin provisions its required components through one supported Host installation flow.

The protocol defines both commitments, their lifecycle ownership, required pre-installation disclosure, and the distinction between user configuration and runtime deployment. The store checklist adds corresponding connection/failure and clean-environment acceptance checks. One flow may download multiple declared artifacts; this does not relax curated-v1 dependency/artifact restrictions or permit installation hooks or README/Skill setup commands.

Only spec/extension-protocol-v0.1.md and catalog/REVIEW_CHECKLIST.md change. No manifest/schema fields, lifecycle states, runtime implementation, catalog entries or policy JSON are added or changed. Host support and any later machine-readable declaration remain separate implementation work.

Related lifecycle design: Code-Amadeus/Amadeus#194. This PR proposes the additional installation commitments for maintainer review.

Validation (Windows, CPython 3.12.10, repository hash-pinned development dependencies):

• Existing offline tests: 151 passed, 16 skipped. Host-dependent cases retain their existing skips without an explicit pinned-Host checkout; no runtime code changed.
• SDK wheel build passed.
• git diff --check passed; the checklist's protocol anchor resolves; the diff is limited to the two requested Markdown files.