feat: initial official marketplace catalog

- integrations/virustotal: VirusTotal v3 (request-based: IP & domain reports)
- templates/: fully-commented manifest + script-command example
- README: discovery rules, manifest schema, how to publish and wire into Riposte

integrations/virustotal/manifest.yaml

@@ -0,0 +1,61 @@
+id: virustotal
+name: VirusTotal
+version: 1.0.0
+description: VirusTotal API v3 — reputation lookups for IPs and domains.
+category: enrichment
+
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: VirusTotal API v3 base URL
+      default: https://www.virustotal.com/api/v3
+    api_key:
+      type: string
+      description: VirusTotal API key
+      x-soar-sensitive: true
+  required:
+    - api_key
+
+auth:
+  - id: apikey
+    type: api_key
+    in: header
+    name: x-apikey
+    value_template: "{{secret}}"
+    secret_field: api_key
+
+commands:
+  - id: get_ip_report
+    name: Get IP report
+    description: Reputation and last-analysis stats for an IP address.
+    inputs_schema:
+      properties:
+        ip:
+          type: string
+          description: IP address to look up
+      required:
+        - ip
+    outputs_schema:
+      properties: {}
+    request:
+      method: GET
+      path: /ip_addresses/{ip}
+      auth_ref: apikey
+
+  - id: get_domain_report
+    name: Get domain report
+    description: Reputation and last-analysis stats for a domain.
+    inputs_schema:
+      properties:
+        domain:
+          type: string
+          description: Domain to look up
+      required:
+        - domain
+    outputs_schema:
+      properties: {}
+    request:
+      method: GET
+      path: /domains/{domain}
+      auth_ref: apikey