Add heygrc (compliance review for pull requests)

[tristanroth1]

Adds heygrc, a compliance review agent for pull requests, to the external plugin collection.

• Repo: https://github.com/better-isms/heygrc-plugin (MIT, public, v0.1.2)
• What it does: heyGRC reviews each PR against ISO 27001, SOC 2, GDPR, DORA, NIS 2, and the EU AI
  Act, grounded in the org's company profile, and posts inline findings, a neutral check run, and a
  sticky summary. It never blocks a merge. Public repositories are free.
• Shape: a setup skill that bridges to the heyGRC GitHub App (install, claim, config-as-code via
  PUT /v1/config). No MCP server, no local review, no second engine.
• Publisher: Better ISMS (the same publisher identity already applied to the Cursor marketplace and
  published in the OpenAI plugins directory). Support: support@ismscopilot.com.
• Manifests: Agent Plugins 1.0 root plugin.json + .claude-plugin marketplace + Codex + Cursor +
  Gemini CLI + skills.sh; validated with claude plugin validate.