fix(ms-ai-architect): RX-P1 installert-modus-hardening — ${CLAUDE_PLUGIN_ROOT}-forankring + scoped agent-delegering [skip-docs]

- Forankre 115 skills/-KB-stier med ${CLAUDE_PLUGIN_ROOT}/ i 26 commands + 10 agenter
  (relative stier resolver kun dev-modus; installert fra katalog mistet subagentene KB-last)
- Foren delegering til registrert scoped navn ms-ai-architect:<agent>
  (var: architect:X feil-namespace + bare navn + general-purpose+"Read agents/X.md")
- Dropp redundant "Read/Les agents/X.md"-instruks (scoped agent auto-laster egen kropp)
- Bevar per-kommando KB-kontrakt inkl. dpia betinget data-residens-ruting (Option B)
- generate-skills: sonnet→opus (opus-direktiv), {PLUGIN_ROOT}→${CLAUDE_PLUGIN_ROOT};
  git-pathspecs holdt repo-relative
- plugin.json repository: ktg-plugin-marketplace→ms-ai-architect (polyrepo egen repo)
- validate-plugin.sh Check 6 (install-safety lint: sti + delegering + opus-only) + node-wrapper i kanonisk suite

tests/kb-update/test-validate-plugin.test.mjs

@@ -0,0 +1,25 @@
+// Wires the static plugin validator (tests/validate-plugin.sh) into the canonical
+// node --test suite so its checks — including RX-P1 Check 6 (install-mode path &
+// delegation safety) — are enforced on every suite run, not just manual invocation.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const pluginRoot = join(here, '..', '..'); // tests/kb-update -> plugin root
+const script = join(pluginRoot, 'tests', 'validate-plugin.sh');
+
+test('validate-plugin.sh passes (frontmatter, encoding, KB refs, plugin.json, install-mode Check 6)', () => {
+  let out;
+  try {
+    out = execFileSync('bash', [script], { encoding: 'utf8', cwd: pluginRoot });
+  } catch (err) {
+    assert.fail(
+      `validate-plugin.sh exited ${err.status}:\n${err.stdout || ''}${err.stderr || ''}`,
+    );
+  }
+  assert.match(out, /VALIDATION PASSED/);
+  assert.doesNotMatch(out, /VALIDATION FAILED/);
+});