Align public plugin distribution and release workflow

[beardly-beem]

What changed

• switch the Endgame-hosted marketplace from a stale self-referencing SHA to "source": "./"
• derive the ZIP payload from tracked Git files under all seven approved skill directories, including future references, examples, assets, and scripts
• add distribution-contract tests for marketplace resolution, recursive skill packaging, ZIP/Git parity, and release-tag semantics
• expand CI to expose the configured lint and three cross-platform test checks, run the official Claude validator, and require plugin version bumps for runtime changes
• add a tag-driven release workflow that validates the exact vMAJOR.MINOR.PATCH revision and attaches the deterministic ZIP plus SHA-256 to its GitHub Release
• document Git as the canonical package and the human-controlled release process

Feedback disposition

Implemented in this PR:

1. keep the plugin at repository root
2. simplify the self-marketplace to a relative root source
3. package complete approved skill directories from tracked Git content
4. make the ZIP a tagged release artifact rather than a second payload inventory
5. test public installation/package structure across Linux, macOS, and Windows

Follow-up after merge:

• submit the public repository to Anthropic's plugin directory
• introduce Release Please only after a dedicated release identity receives a narrowly scoped ruleset bypass

Release Please is intentionally not enabled here. The current public-repository rules restrict all branch and tag creation to the maintainer account; granting every GitHub Actions workflow a blanket bypass would weaken that boundary. The tag-driven workflow works with the existing policy because a maintainer creates the reviewed tag and Actions only builds and publishes artifacts from it.

Version impact

The runtime plugin payload is unchanged, so the manifest remains at 0.1.6. CI now requires a version bump whenever future changes touch the plugin manifest, MCP configuration, license, or any approved skill directory.

Validation

• make check
• claude plugin validate . --strict
• make package twice with identical SHA-256: e07689083535110e7878b792d9cabae12e29e51733b0966c1d027f887df12955
• exact ZIP/Git runtime-file parity
• python3 scripts/check_release_tag.py v0.1.6
• python3 scripts/check_version_bump.py origin/main HEAD
• source and packaged MCP discovery
• workflow YAML parse
• git diff --check

MCP discovery succeeded for both source and package. The restricted local environment returned ENOTFOUND for app.endgame.io, so endpoint/OAuth health was not claimed as validated.

[rtyer]

Refutation-gated mult-review of the current head. The overall Git-root and tagged-artifact approach is sound; these are the localized findings that survived verification.

[rtyer]

looks good, nice work