feat: add Subotiz billing & payments plugin

[Subotiz]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the staged branch for this pull request.

---

Description

Adds a new subotiz plugin that connects GitHub Copilot to Subotiz — a global subscription growth engine and Merchant-of-Record (MoR) platform for AI products, SaaS, and digital businesses.

The plugin bundles a remote (Streamable HTTP) MCP server plus a guiding skill, letting Copilot manage usage-based billing, subscriptions, global payments, tax compliance, invoices, and refunds across 180+ countries and 150+ currencies via natural language.

Contents:

• plugins/subotiz/.mcp.json — two remote servers: subotiz (production) and subotiz-sandbox (testing).
• plugins/subotiz/.github/plugin/plugin.json — plugin manifest.
• skills/use-subotiz/ — skill describing the available tools (list_customer, create_product, list_subscription, list_trades, list_invoice, list_refund, …) and payment-grade safety rules (confirm before any write/refund, never log the API key).
• plugins/subotiz/README.md — setup and usage docs.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

Paid service disclosure: Subotiz is a commercial payments/billing platform. The plugin itself is free to install and adds nothing proprietary to the repo — it only points Copilot at Subotiz's officially hosted MCP endpoints. Using the tools requires the user's own
Subotiz API Key.

• No secrets committed. The API Key is never hardcoded. It is read from the SUBOTIZ_API_KEY (production) / SUBOTIZ_SANDBOX_API_KEY (sandbox) environment variables via the Authorization: Bearer ${...} header in .mcp.json.
• Safe-by-default. A dedicated sandbox server is provided for testing, and the skill instructs the agent to confirm before any mutating/refund operation.
• npm run plugin:validate passes (All 68 plugins and the external catalog are valid).

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🔒 PR Risk Scan Results

Scanned 8 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	2
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	unpinned-version-indicator	.codespellrc	21	# categor - TypeScript template literal in website/src/scripts/pages/skills.ts:70 (categor${...length > 1 ? "ies" : "y"})
🟠	package-exec-command	docs/README.skills.md	31	| [acreadiness-assess](../skills/acreadiness-assess/SKILL.md)<br />`gh skills install github/awesome-copilot acreadiness-assess` | Run the AgentRC readiness assessment on the curre

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔍 Skill Validator Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	Found 1 skill(s)
ℹ️	[use-subotiz] 📊 use-subotiz: 1,046 BPE tokens [chars/4: 1,085] (detailed ✓), 9 sections, 3 code blocks
ℹ️	✅ All checks passed (1 skill(s))

Full validator output

Found 1 skill(s)
[use-subotiz] 📊 use-subotiz: 1,046 BPE tokens [chars/4: 1,085] (detailed ✓), 9 sections, 3 code blocks
✅ All checks passed (1 skill(s))