Installs previously drifted: a standalone `npx skills add` copy never
followed the repo, and Claude Code disables auto-update for third-party
marketplaces by default. Route every client through its own marketplace so
merged changes reach users through the native update path.
- Add `.agents/plugins/marketplace.json` so Codex resolves the plugin from
a Git marketplace it refreshes at startup.
- Add `author` to the Claude manifest so both native manifests agree.
- Add `scripts/bump-plugin-version.py` to increment the Claude and Codex
versions together; it refuses to run when they already differ.
- Add `scripts/verify-plugin-package.py` to gate synchronized, strictly
increasing semver against the base ref, marketplace paths that stay
inside the repo root, and the packaged skill.
- Add `scripts/test-plugin-package.py` covering the adversarial cases:
missing bump, mismatched manifests, malformed semver, and a marketplace
target that does not exist.
- Add a `plugin-package` CI job running the tests, the version gate against
the PR base sha, and `claude plugin validate . --strict`.
- Document the per-PR bump requirement, the new gates, and the per-client
install/update paths, including the one-time migration off standalone
copies.
Version bumps 2.3.0 -> 2.3.1 to satisfy the new gate.
Cathryn Lavery
b6cae1e2e6