feat(marketplace): make the skill a gateway and add marketplace add

[unional]

Closes #88. Covers the first half of #86.

Why

marketplace init derives a catalog from the plugins a repository holds. A repository that
curates plugins living somewhere else — the way cyberuni/marketplace does — had no command at
all, so the entry had to be hand-written into a catalog, which the skill forbids precisely because
a hand-assembled catalog carries the shapes every runtime refuses.

marketplace add <spec>

One positional names where the plugin lives, disambiguated by shape:

Spec	Source written
./plugins/alpha	"./plugins/alpha"
cyberuni/universal-plugin	{ "source": "github", "repo": … }
https://…, git@…	{ "source": "url", "url": … }
npm:repobuddy, @cyberuni/upx	{ "source": "npm", "package": … }
repobuddy@cyberplace	whatever that marketplace publishes

Two shapes collide and each has a flag that settles it. plugins/alpha reads as a GitHub repository
— owner/repo and a relative path are the same string, and consulting the filesystem would make it
mean different things in different working directories. A leading @ is a scope, so @cyberuni/upx
is a package while upx@cyberplace is a marketplace entry. --path, --npm, --github, --url,
and --from-marketplace force the reading.

Monorepos. Neither github nor url has a field for a directory inside the repository, so
--subdir turns the source into git-subdir and names the entry for that directory:

marketplace add cyberuni/cyber-sdd --subdir plugins/aced
# aced -> {"source":"git-subdir","url":"https://github.com/cyberuni/cyber-sdd.git","path":"plugins/aced"}

--ref and --sha pin a git source. All three apply to a git-backed source only and say so rather
than being ignored; a --sha is checked against the 40-character hash the schema requires, at input
rather than against the catalog schema at install time.

Copying from another marketplace. The schema has no "from another marketplace" source, so the
entry is resolved and copied. A source relative to that marketplace is rewritten, not refused —
it names a location inside a repository whose URL is known:

Entry there	Written here
./plugins/cyberspace in cyberuni/cyberplace	{"source":"git-subdir","url":"https://github.com/cyberuni/cyberplace.git","path":"plugins/cyberspace"}
./ in unional/skills	{"source":"github","repo":"unional/skills"}

The origin comes from what the runtime recorded in known_marketplaces.json, falling back to the
clone's own git remote — which is also how --from <dir> resolves one. Only a marketplace with
neither stops the run.

Per-runtime source support. An entry only reaches a catalog whose runtime can resolve it. Claude
Code takes the schema's full tagged set, Codex takes npm, Copilot CLI and Cursor take local paths
only. The rest are reported skipped with the reason rather than written a source they refuse:

target   status   entry      reason
claude   added    repobuddy
codex    added    repobuddy
copilot  skipped  repobuddy  npm source is not supported by copilot
cursor   skipped  repobuddy  npm source is not supported by cursor

A prerequisite: regeneration stopped discarding entries

marketplace init rebuilt catalogs from discovery alone, so an added entry was a conflict and then a
deletion under --force. init, plugin build, and plugin init now keep an entry whose source is
not a local path, and keep a non-local source on a plugin they do discover while refreshing its
derived metadata. That is the loss in #86 — a plugin shipped through npm, whose repository path holds
gitignored build output, was rewritten to that path on every build. What discovery owns it still
owns: a local-path entry it no longer finds is dropped.

The skill is now a gateway

SKILL.md holds no procedure. It declares the routes in argument-hint, carries the intake, the
runtime table, and the shared rules, and names one reference per route: references/init.md (today's
steps, moved), references/add.md (new), and references/validate.md — which was the last step of
init and is now one home rather than two, since both writing routes end there.

One user-invocable skill with routes, rather than marketplace-init and marketplace-add skills
competing to trigger on the same phrases.

Decisions worth a reviewer's eye

• No network. Metadata comes from a path's own plugin.json, an installed node_modules copy,
  the entry being copied, or the metadata flags. The marketplace spec's non-goals name "calling a
  marketplace API" and nothing in src/ does network I/O. A --fetch flag stays open.
• --author is not supported. It would have meant changing the shared serializer, which would
  have added author to discovered entries too.
• npm version/registry are not exposed. --version is already the entry's metadata version;
  overloading it would be confusing.

Verification

731 tests, 726 passing, and plugin build --check is clean.

End to end in a scratch repository: init → add npm:repobuddy → add <plugin>@cyberplace →
init --force keeps all three entries, and all four catalogs validate. The <plugin>@<marketplace>
path was exercised against the real installed cyberplace and unional clones, both the
subdirectory and root cases, not only against fixtures.

CI will be red on 5 tests that are already red on main — four in src/build/build.test.ts and
one in src/init/init.test.ts, all about catalog refresh. I verified this in a clean origin/main
worktree at e76bd25, where they fail identically with none of this branch's code present. They are
not diagnosed here: reading src/build/ is blocked by local permission settings.

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 49ffa79

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
universal-plugin	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR