feat: add Flueny coding-fluency plugin

[jay-flueny]

What this PR does

• Plugin name: flueny
• Type: remote source
• Source URL + pinned SHA: https://github.com/FluenyAI/app-plugin-grok.git @ 5c5c032fb296ddc13d76de42a9d2ee48db403c82
• Homepage: https://flueny.ai

Adds Flueny to the official Grok Build catalog from the Grok-facing source repo (FluenyAI/app-plugin-grok). This is not the Claude Code plugin repo.

Flueny is a coding-fluency client: slash commands (/flueny:connect, /flueny:status) and SessionStart / PostToolUse / Stop / SessionEnd hooks. Extraction runs on the machine. Only derived signal is sent to the Flueny API. Prompts, code, and file contents never leave the machine.

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (or I've explained why not below).

Published from FluenyAI/app-plugin-grok.

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set; local plugins include README.md + .grok-plugin/plugin.json.
• License is stated.

The plugin repo does not yet ship a LICENSE file. Happy to add one (MIT or Apache-2.0) and bump the pin if that is required to land.

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege.
• Network endpoints this plugin calls (and why):
  • https://api.flueny.dev (production default) and the org's configured Flueny API, for OAuth device sign-in (/oauth/device, /oauth/token), session handshake (/integrations/coding/session/start), and derived event ingest (/integrations/coding/events).
• Credentials/permissions it requires (and why):
  • A Flueny hook token from device OAuth, stored mode 0600 under ~/.config/flueny/credentials.grok-build.json.
  • --trust so the hooks can run. Hooks are type: command because extraction must happen locally; an http hook would post the raw payload off the machine.
  • PostToolUse matcher is * because the product measures every tool call, not only edits. The hook fails open and prints nothing.

The plugin has no MCP servers, no skills that download binaries, and no postinstall.

Notes for reviewers

• Source is FluenyAI/app-plugin-grok, the Grok distribution. Claude Code uses a different repo.
• grok plugin validate on that SHA reports name flueny, commands, and hooks.