feat: install plugins from approved source commits

netbox_plugin/netbox_plugin_store/lifecycle.py

@@ -235,6 +235,8 @@ class LifecycleService:
             raise LifecycleError("Approved release has no artifact URL.")
         if not release.sha256:
             raise LifecycleError("Approved release has no artifact SHA-256. Commit hashes are not accepted.")
+        if release.artifact_kind not in {"wheel", "source_archive"}:
+            raise LifecycleError("Approved release has an unsupported artifact type.")
 
     @staticmethod
     def _assert_state(action: str, installed: str, enabled: bool, runtime_active: bool) -> None:
@@ -287,6 +289,8 @@ class LifecycleService:
         return suffix if re.fullmatch(r"\.[A-Za-z0-9.]{1,16}", suffix) else ".artifact"
 
     def _download(self, release: Release, directory: Path) -> Path:
+        if release.artifact_kind == "source_archive":
+            raise LifecycleError("Source archives require execution_mode='agent' for a verified local wheel build.")
         artifact = directory / f"artifact{self._artifact_suffix(release)}"
         self.client.download_artifact(
             release.download_url,