feat(scripts): add marketplace version-consistency gate

scripts/check-versions.mjs cross-checks every plugin in marketplace.json against
its sibling repo:
- catalog ref must resolve to a real git tag    → ERROR (dangling = install breaks)
- plugin.json version == README version-badge    → ERROR (internal corruption)
- catalog ref == plugin.json version             → WARN (catalog lags / unreleased bump)
- sibling repo missing                           → SKIP

Exit 1 on any ERROR; --strict also fails on WARN. Pure classifier covered by
check-versions.test.mjs (9 tests, node --test). Documented in CLAUDE.md
catalog-maintenance. Run before committing any ref change.

Current run: 8 OK, 2 WARN (linkedin-studio, ms-ai-architect — catalog ref lags an
untagged plugin.json bump), 0 ERROR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

CLAUDE.md

@@ -18,3 +18,9 @@ their own Forgejo repositories under `https://git.fromaitochitta.com/open/`.
 - Adding/updating a plugin entry: edit `.claude-plugin/marketplace.json` (external `source: "url"` with
   a pinned `ref`) and re-state the plugin in README.md with its verified version.
 - Plugin source, issues, and releases live in each plugin's own repository — not here.
+- **Version-consistency gate:** run `node scripts/check-versions.mjs` before committing any `ref`
+  change. For each plugin it checks (against the sibling repo) that the catalog `ref` resolves to a
+  real git tag (ERROR if dangling — breaks install), that `plugin.json` version == README
+  version-badge (ERROR), and that the catalog `ref` matches `plugin.json` version (WARN — catalog
+  lags or an unreleased bump). Exit 1 on any ERROR; `--strict` also fails on WARN. Pure-function
+  core covered by `scripts/check-versions.test.mjs` (`node --test scripts/check-versions.test.mjs`).