feat: add the rms plugin to the marketplace

[navado]

Adds /plugin install rms@kdcube — requirements captured as a side-effect of coding work: the rms stdio MCP server, an inbox-first capture/review loop, code markers for traceability, and conformance validation.

What's in this PR

File	Change
.claude-plugin/marketplace.json	The rms entry
README.md	Install line, plugin table row, new External plugin sources section, naming-convention note
CHANGELOG.md	Unreleased → Added

No plugin code lands here. That's the point of the next section.

Why rms is sourced from another repository

This is the marketplace's first entry that doesn't live in plugins/claude/. It uses a git-subdir source pinned by ref:

"source": {
  "source": "git-subdir",
  "url": "https://github.com/kdcube/rms-rs.git",
  "path": "claude-plugin",
  "ref": "v0.1.0"
}

The reason is correctness, not convenience. The rms plugin ships integration text that the rms binary generates and content-hashes (INTEGRATION_VERSION + blake3), and rms validate verifies that hash at runtime, reporting synced / outdated / tampered. If the plugin shipped from here, plugin and binary would have independent release cadences — and a user who just installed the plugin could have it report outdated against the binary the plugin itself had just fetched.

Co-locating plugin and binary in one repository, released under one tag, removes that failure mode by construction. The ref pin then keeps this repository in control: nothing upstream reaches users until a bump lands here and is reviewed.

README.md documents this as a bounded exception — appropriate when a plugin is generated by, or version-locked to, an artifact built elsewhere — with in-tree remaining the default.

Naming convention

Checked against both rules in the README:

1. Brand-distinctive, not generic — rms is the product's own name, not a capability word like requirements or docs.
2. One canonical name across surfaces — already the name of the binary, the CLI and the MCP server, so /rms:<command> matches what the tool calls itself everywhere else.

Blocked on — this is why it's a draft

kdcube/rms-rs does not exist yet. Until it does and carries a v0.1.0 tag with claude-plugin/ in it, this entry resolves to nothing and installing rms@kdcube will fail.

Merge checklist:

• kdcube/rms-rs created and pushed
• claude-plugin/ present in that repo (manifest, Setup hook, commands, bootstrap skill)
• v0.1.0 tagged, with release archives attached for the Setup hook to fetch
• /plugin marketplace add kdcube/agent-plugins → /plugin install rms@kdcube verified on a machine with no Rust and no Node
• rms validate reports synced after a plugin-driven rms init

If the tag lands under a different version, update ref before merging.

Plan and rationale: kdcube/rms#2.

🤖 Generated with Claude Code

https://claude.ai/code/session_01J1XGNXitstXGgVJ9ps2e7X