feat: add Ulanzi D200X command executor

[mcoder2014]

Summary

• add a macOS-only Ulanzi D200X command_executor plugin under plugins/unlanzi_d200x/command_executor
• let every dragged Keypad action keep an independent title, complete Shell command, working directory, and environment-variable configuration
• execute commands with the current user's login Shell, preserving pipes, quotes, redirections, multiline scripts, and 100-200 inline arguments
• vendor the fixed official Ulanzi Node and HTML SDK snapshots unchanged, with provenance, licenses, SHA-256 verification, packaging validation, and macOS CI
• add design, implementation, installation, development, user, debugging, and validation documentation with a desensitized real Ulanzi Studio screenshot
• fix Alfred multi-file Finder clipboard handling by requesting one result for every macOS pasteboard item

User impact

A D200X button can now run a command configured directly in Ulanzi Studio, close to how it would be entered in a terminal. Multiple buttons can use the same action with different settings, and Studio restores those settings after restart.

Configuration

• button title
• complete Shell command
• working directory: empty, ~, ~/..., or an absolute path
• environment variables: one KEY=VALUE per line

The plugin uses $SHELL -lc. Explicit panel variables are exported after the login profile loads, so they override inherited or profile values.

Validation

• npm ci --cache=/private/tmp/life_tools_ulanzi_npm_cache_final --registry=https://registry.npmjs.org
• npm test: 75 tests, 75 passed, 0 failed
• bash -n build.sh
• ./build.sh
• package validator passed; install directory contains 40 files
• zip integrity passed; final zip is 95,933 bytes
• bundle is 181,170 bytes with SHA-256 ad6b0f6d524f51b74f4bb6dcfc021848247ed2c9a590f900ae41e4b49c29f36e
• both Mermaid diagrams rendered successfully with mmdc
• GitHub Actions YAML parsed successfully
• Alfred offline tests passed
• Alfred real macOS clipboard integration passed in 10 consecutive local runs and in GitHub Actions
• all PR checks passed: Alfred, Ulanzi, Swift, and release packaging

Real Studio and D200X verification

• installed into the local Ulanzi plugin directory and fully restarted Ulanzi Studio 3.1.9
• confirmed D200X connected, plugin/action visible, Property Inspector loaded, and main WebSocket connected
• configured two physical buttons with independent action IDs and settings; both settings restored after Studio restart
• pressed both physical D200X buttons and confirmed exit code 0 in the plugin log
• verified inherited user environment without storing its values in the repository
• verified explicit environment override and working directory
• verified a no-argument command, quoting, a pipeline, redirection, and exactly 200 inline arguments (arg001 through arg200)
• installation bundle and build bundle SHA-256 matched

SDK snapshots

• UlanziTechnology/UlanziDeckPlugin-SDK: 550ab80c69285ecf259bd494a7fff767c14f0c0f
• UlanziTechnology/plugin-common-node: 112bd13a7ff9d45bd68656f7e069fd61851d1812
• UlanziTechnology/plugin-common-html: 79de0b0b087546e684afd23f97223f7a7bc392da

Privacy review

• current reachable PR history contains two focused commits using the public GitHub noreply identity
• no personal/company email, local username, user-specific absolute path, token, private key, device serial, or committed runtime payload was found in the current PR diff
• only one desensitized Studio screenshot remains; local disk and CPU/RAM/GPU values and unrelated button layouts are not retained

Boundaries and known warnings

• macOS 10.15+, D200X Keypad, and Ulanzi Studio 3.0.11+ only
• no interactive stdin, password prompts, timeout, stop button, process recovery, or execution history
• the unchanged official SDK keeps complete WebSocket payload diagnostics, which may include local command and environment configuration
• Webpack reports missing optional ws accelerators bufferutil and utf-8-validate; the build, package checks, Studio load, and physical execution all pass without them
• the current npm audit snapshot reports advisories in the Webpack chain and ws with no available fix; details are recorded in the validation report