ci: fail when plugin/marketplace/skill versions drift from package.json

[kdr]

Why

.claude-plugin/plugin.json and .claude-plugin/marketplace.json were still on 0.3.19 through both the 0.3.20 and 0.3.21 releases. Nothing checked them, so the drift only surfaced when it was noticed by hand during the 0.3.22 release. The existing Plugin + skill metadata job validated that these files parse — not that their versions mean anything.

What

Two new steps in that same job:

Plugin + marketplace versions match package.json — covers plugin.json's version, marketplace.json's metadata.version, and every plugins[].version entry. The npm package version is the release version, so all of them must equal it. Prints a per-field ok/DRIFT table so a failure names the offending file straight away:

ok   package.json = 0.3.22
ok   .claude-plugin/plugin.json = 0.3.22
ok   .claude-plugin/marketplace.json metadata.version = 0.3.22
ok   .claude-plugin/marketplace.json plugins[tinycloud].version = 0.3.22

Skill manifest version matches package.json — pins tinycloud-skill.json's skill_version.

Deliberately only skill_version: min_version / supported_range are the compatibility floor, already diffed against preflight.sh by the next step, and they may legitimately sit below the release version on a no-raise release — 0.3.13 and 0.3.19 both shipped that way. Pinning them here would have failed those releases for no reason.

Verified both directions

• Passes on the current tree — all four version fields at 0.3.22.
• Fails when the exact historical drift is re-injected (plugin.json → 0.3.19):

  DRIFT .claude-plugin/plugin.json = 0.3.19
  Version drift against package.json (0.3.22): {'.claude-plugin/plugin.json': '0.3.19'}
  exit 1
  

No behavior change to the shipped package — CI only.

[cursor]

PR Summary

Low Risk
CI-only metadata version checks; no runtime, packaging, or security behavior changes.

Overview
Adds two CI checks in the Plugin + skill metadata job so plugin and skill version fields cannot silently lag package.json (as they did through 0.3.20–0.3.21).

The first step requires plugin.json version, marketplace.json metadata.version, and every plugins[].version to equal the npm package version, printing an ok/DRIFT table on failure. The second pins tinycloud-skill.json skill_version only — min_version/supported_range stay out of this check because they are compatibility floors already compared to preflight.sh and may legitimately sit below a release.

^{Reviewed by Cursor Bugbot for commit 8d47e67. Bugbot is set up for automated code reviews on this repo. Configure here.}