0.7.0 invalidated the three published plugin distributions; they need republishing

[open-coder-ai]

What

The five-axis migration in #73 changed the compiled guard runtime. The three distribution repositories were published by framework v0.6.0 and have not been republished, so each one's Generated-only check now fails against chock's current main:

Repository	Last published as	Generated-only
chock-claude-plugins	generated: catalog 3e01994… (framework v0.6.0)	red
chock-cursor-plugins	v0.6.0-era	red
chock-codex-plugins	v0.6.0-era	red

Those workflows check out open-coder-ai/chock at current main and regenerate, so the failure appeared the moment 0.7.0 merged — no push to the distribution repos was involved. Run #21 of Generated-only on chock-claude-plugins' main was green on 2026-08-29 under 0.6.0; the same run today fails on the guard runtime diff (the Cursor permission: deny JSON and Codex exit-code block).

Why this is worth fixing promptly rather than at the next publish

Generated-only is not a lint — its own workflow comment calls it "the security argument": it proves that what a user installs is exactly what the catalog published. While it is red:

• that proof is unavailable for all three published distributions, which is the strongest claim those repos make;
• a genuine tampering diff would be indistinguishable from this standing failure;
• the shipped plugins still carry the 0.6.0 runtime, so adopters installing today get the pre-migration behaviour while the catalog and framework have moved on.

What done looks like

1. Run publish.yml on each of the three repositories against chock 0.7.0.
2. Confirm Generated-only goes green on main in all three.
3. Diff the regenerated runtime deliberately rather than rubber-stamping it: the migration re-graded 16 coverage cells, so if any plugin's stated enforcement tier moved, that belongs in the publish notes.

Related: chock-catalog#45 is the same 0.6→0.7 staleness in the catalog's own compiled artifacts. Both come from the same migration; neither is a defect in it.

Found while adding badges to the three distribution READMEs (chock-claude-plugins#2, chock-cursor-plugins#1, chock-codex-plugins#1) — those PRs touch only README.md, which is deliberately exempt from generation, and are blocked behind this.