feat(catalog): release-plugin.mjs — atomic catalog-ref release helper

The polyrepo split made a plugin release a TWO-repo act: tag the plugin repo AND
bump the catalog `ref`. The second step is manual and easily forgotten — that
drift just stranded linkedin-studio on v0.4.0 while its plugin.json moved to
0.5.0. This adds the canonical release path that makes the catalog side
impossible to do wrong.

scripts/release-plugin.mjs:
- Pure planner planRelease() — given the catalog + observed plugin state +
  target version, computes verdict (READY/NOOP/BLOCKED), the bumped marketplace
  object, and the commit subject. REFUSES (BLOCKED) unless plugin.json == README
  badge == target AND the vX.Y.Z tag exists, so a READY plan is check-versions-
  green by construction. Reuses normalizeVersion/classifyPlugin from
  check-versions.mjs (no duplicated rules).
- I/O shell: dry-run by default; --write bumps the ref + re-runs the gate;
  --commit/--push apply; --create-tag mints+pushes a missing plugin tag first.
- 10/10 unit tests (scripts/release-plugin.test.mjs); check-versions 9/9 still green.
- Dogfooded: linkedin-studio → NOOP (already pinned v0.5.0); ms-ai-architect →
  BLOCKED (v1.16.0 in plugin.json was never tagged — refuses to publish it).

Also: fix the stale LinkedIn Studio README label v0.4.0 -> v0.5.0 (loose end of
the v0.5.0 release), and document the canonical release path in CLAUDE.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -114,7 +114,7 @@ Key commands: `/architect`, `/architect:ros`, `/architect:security`, `/architect
 
 ---
 
-### [LinkedIn Studio](https://git.fromaitochitta.com/open/linkedin-studio) `v0.4.0`
+### [LinkedIn Studio](https://git.fromaitochitta.com/open/linkedin-studio) `v0.5.0`
 
 Build authentic LinkedIn authority through algorithmic understanding, strategic consistency, and AI-assisted content creation.