feat(catalog): gate catalog README labels against ref + close the drift

The catalog README's per-plugin `vX.Y.Z` labels were an UNGUARDED surface:
check-versions validated each plugin's OWN README badge, never the catalog
README's labels, so they drifted (config-audit shown v5.5.0 while pinned to
v5.7.0; voyage v5.1.1 while pinned to v5.6.0) — the doc misstated what
`claude plugin install` actually resolves.

Close the class, same pattern as the ref surface:
- check-versions.mjs: new ERROR rule "catalog README label == catalog ref"
  via pure extractCatalogLabel() (matches the /open/<name>) heading, takes the
  first `vX.Y.Z`, ignores a trailing lang/flag badge). No legitimate transient
  state lets label != ref, so ERROR (not WARN). +5 tests.
- release-plugin.mjs: on --write, bump the README label atomically with the ref
  via pure reconcileReadmeLabel() and git add README.md on --commit, so future
  releases keep label and ref in lock-step. +4 tests.
- README.md: reconcile the 2 stale labels (config-audit -> v5.7.0,
  voyage -> v5.6.0). Gate now 9 OK / 1 WARN / 0 ERROR.
- CLAUDE.md: doctrine updated to document the new gate rule + atomic label bump.

ms-ai-architect stays WARN by decision (1.16.0 is unreleased WIP, never tagged).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cm2RxKbomdLqjiWGcwCCPi

scripts/check-versions.test.mjs

@@ -6,6 +6,7 @@ import assert from 'node:assert/strict';
 import {
   normalizeVersion,
   extractBadgeVersion,
+  extractCatalogLabel,
   classifyPlugin,
 } from './check-versions.mjs';
 
@@ -65,6 +66,53 @@ test('plugin.json ahead with no tag of its own → WARN, flags unreleased/untagg
   assert.ok(r.findings.some(f => f.level === 'WARN' && /never tagged|unreleased/.test(f.msg)));
 });
 
+test('extractCatalogLabel reads the catalog README label by plugin name', () => {
+  const readme = [
+    '### [Config-Audit](https://git.fromaitochitta.com/open/config-audit) `v5.7.0`',
+    '### [MS AI Architect](https://git.fromaitochitta.com/open/ms-ai-architect) `v1.15.0` `🇳🇴 Norwegian`',
+  ].join('\n');
+  assert.equal(extractCatalogLabel(readme, 'config-audit'), '5.7.0');
+  // first vX.Y.Z token wins — trailing flag/lang badge on the same line is ignored
+  assert.equal(extractCatalogLabel(readme, 'ms-ai-architect'), '1.15.0');
+  // no heading for this plugin → null (check is skipped)
+  assert.equal(extractCatalogLabel(readme, 'ghost'), null);
+});
+
+test('catalog README label != catalog ref → ERROR (doc misstates installed version)', () => {
+  const r = classifyPlugin({
+    name: 'config-audit', catalogRef: 'v5.7.0', pluginVersion: '5.7.0',
+    readmeBadge: '5.7.0', tags: ['v5.7.0'], catalogLabel: '5.5.0',
+  });
+  assert.equal(r.status, 'ERROR');
+  assert.ok(r.findings.some(f => f.level === 'ERROR' && /README label/.test(f.msg)));
+});
+
+test('catalog README label == catalog ref → no label finding (stays OK)', () => {
+  const r = classifyPlugin({
+    name: 'config-audit', catalogRef: 'v5.7.0', pluginVersion: '5.7.0',
+    readmeBadge: '5.7.0', tags: ['v5.7.0'], catalogLabel: '5.7.0',
+  });
+  assert.equal(r.status, 'OK');
+});
+
+test('label check does not fire on the legitimate ref-lags-plugin.json WARN case', () => {
+  // ref v1.15.0 lags plugin.json 1.16.0 (WARN), but the label matches the ref → no extra ERROR
+  const r = classifyPlugin({
+    name: 'ms-ai-architect', catalogRef: 'v1.15.0', pluginVersion: '1.16.0',
+    readmeBadge: '1.16.0', tags: ['v1.15.0'], catalogLabel: '1.15.0',
+  });
+  assert.equal(r.status, 'WARN');
+  assert.ok(!r.findings.some(f => f.level === 'ERROR'));
+});
+
+test('catalogLabel omitted (legacy callers) → label check skipped', () => {
+  const r = classifyPlugin({
+    name: 'x', catalogRef: 'v1.0.0', pluginVersion: '1.0.0',
+    readmeBadge: '1.0.0', tags: ['v1.0.0'],
+  });
+  assert.equal(r.status, 'OK');
+});
+
 test('plugin repo not found locally → SKIP', () => {
   const r = classifyPlugin({
     name: 'gone', catalogRef: 'v1.0.0', pluginVersion: null,