feat(plugin): automatic updates via native marketplaces and a version gate

Installs previously drifted: a standalone `npx skills add` copy never
followed the repo, and Claude Code disables auto-update for third-party
marketplaces by default. Route every client through its own marketplace so
merged changes reach users through the native update path.

- Add `.agents/plugins/marketplace.json` so Codex resolves the plugin from
  a Git marketplace it refreshes at startup.
- Add `author` to the Claude manifest so both native manifests agree.
- Add `scripts/bump-plugin-version.py` to increment the Claude and Codex
  versions together; it refuses to run when they already differ.
- Add `scripts/verify-plugin-package.py` to gate synchronized, strictly
  increasing semver against the base ref, marketplace paths that stay
  inside the repo root, and the packaged skill.
- Add `scripts/test-plugin-package.py` covering the adversarial cases:
  missing bump, mismatched manifests, malformed semver, and a marketplace
  target that does not exist.
- Add a `plugin-package` CI job running the tests, the version gate against
  the PR base sha, and `claude plugin validate . --strict`.
- Document the per-PR bump requirement, the new gates, and the per-client
  install/update paths, including the one-time migration off standalone
  copies.

Version bumps 2.3.0 -> 2.3.1 to satisfy the new gate.

.github/workflows/ci.yml

@@ -14,6 +14,43 @@ env:
   PYTHONUTF8: "1"
 
 jobs:
+  plugin-package:
+    name: Plugin Package & Version Gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout repository history
+        uses: actions/checkout@v4
+        env:
+          GIT_CONFIG_COUNT: "1"
+          GIT_CONFIG_KEY_0: "core.autocrlf"
+          GIT_CONFIG_VALUE_0: "false"
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Test plugin package tooling
+        run: python3 scripts/test-plugin-package.py
+
+      - name: Require a synchronized plugin version bump
+        env:
+          BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+        run: python3 scripts/verify-plugin-package.py "$BASE_REF"
+
+      - name: Validate Claude marketplace package without warnings
+        run: npx --yes @anthropic-ai/claude-code@2.1.229 plugin validate . --strict
+
   validate:
     name: Lint & Verify (${{ matrix.os }}, Python ${{ matrix.python-version }})
     strategy: