fix(package): include pyproject.toml so an installed copy can bootstrap

scripts/bootstrap.py resolves --group against <repo-root>/pyproject.toml,
but package_plugin.py's INCLUDE tuple never shipped that file. An archive
built and unpacked elsewhere could never bootstrap (F1). Verify: built an
archive with package_plugin.py, unpacked it to a tmp dir, ran
scripts/bootstrap.py against the unpacked copy -- "bootstrap: guard 1.3.0"
/ "bootstrap: ok", exit 0. Also fixed two stale pyproject.toml comments
still naming the pre-port scripts/bootstrap.sh.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

pyproject.toml

@@ -3,7 +3,7 @@
 # This is deliberately NOT an installable distribution. Nothing here needs a
 # build backend: the tests import from `scripts/` via pytest's `pythonpath`,
 # and the dependencies are declared as a PEP 735 dependency group that
-# `scripts/bootstrap.sh` installs with `pip install --group dev`. Adding a
+# `scripts/bootstrap.py` installs with `pip install --group dev`. Adding a
 # build backend would buy a packaging step this repo never uses.
 
 [dependency-groups]
@@ -16,7 +16,7 @@ dev = [
     # to substitute a different one.
     "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v1.3.0",
 ]
-# Optional extra, installed by `scripts/bootstrap.sh --med-xlsx`. Declared here
+# Optional extra, installed by `scripts/bootstrap.py --med-xlsx`. Declared here
 # so the spreadsheet export path is reachable on a clean bootstrap instead of
 # being asserted against a library nothing installs.
 xlsx = [

scripts/package_plugin.py

@@ -51,6 +51,7 @@ INCLUDE = (
     "SECURITY.md",
     "LICENSE",
     "BUILD_STAMP",
+    "pyproject.toml",
 )
 REQUIRED = (".claude-plugin/plugin.json", "BUILD_STAMP")
 

tests/test_plugin_manifest.py

@@ -246,7 +246,9 @@ def test_the_archive_ships_no_local_only_or_operator_private_path(arkiv):
             )
 
     # And the things it must carry, so an over-eager exclusion is caught too.
-    for pakket in (".claude-plugin/plugin.json", ".mcp.json", "BUILD_STAMP", "LICENSE"):
+    # pyproject.toml is what scripts/bootstrap.py resolves `--group` against;
+    # an archive without it can never bootstrap once installed (F1).
+    for pakket in (".claude-plugin/plugin.json", ".mcp.json", "BUILD_STAMP", "LICENSE", "pyproject.toml"):
         assert pakket in oppforinger, (
             "the archive is missing %r; it holds %r" % (pakket, sorted(oppforinger))
         )