feat(gate): install truth, honest badges anywhere, and two stripCode bugs

Install truth is the brief's first control and the gate only checked
syntax. Now: the marketplace URL must be the real one (offline, from the
register), and the plugin must actually be pinned in the catalog (one
call, SKIP if unreachable). A well-formed `claude plugin install x@mkt`
fails silently when x was never pinned.

This makes the gate block ITSELF until publication finishes - the run
against this repo now has exactly one ERROR, and it is true: repo-standard
is not in the catalog yet. That is the post-publish acceptance test,
enforced mechanically instead of remembered.

Badge honesty no longer keys on img.shields.io. A self-hosted SVG asserts
the same unverified thing, and the README claimed the general rule while
the code checked one host.

Two stripCode bugs, both silent false passes:
- 4-space indent treated as code unconditionally made links inside nested
  list items invisible. Fixed by requiring a blank line to OPEN a block.
- That fix alone ended the block after line 1, so multi-line indented
  templates leaked back into scanning. Caught by the gate on this repo's
  own SKILL.md, which shows a README template containing a CHANGELOG link.
A block now opens on a blank line and continues while the indent holds.

Also corrected two claims in this README: it said "one network call"
when there are two, and it still argued against a CONTRIBUTING using
reasoning the solo-maintainer section had already replaced.

77 tests. llm-security regression: still zero link and boilerplate noise.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WYJ3FHLtVgzFXMZ6UF598h

CHANGELOG.md

@@ -38,11 +38,16 @@ First release. Covers the checks that a single repository can answer on its own.
 - **Badge honesty** — a static badge asserting a test, build or coverage run is
   a claim dressed as evidence. Version, licence and platform badges assert no
   run and are fine.
+- **Install truth, not just install syntax** — the marketplace URL in the install
+  block must be the real one (offline, against the register), and the plugin must
+  actually be pinned in the catalog (one call; `SKIP` if unreachable). A perfectly
+  formed `claude plugin install x@mkt` fails silently when `x` was never pinned,
+  and that is the single most disqualifying thing a repo can publish.
 - **Boilerplate, licence-claim and relative-link checks.**
 - **The skill** (`skills/repo-standard/`) — the judgement the script cannot
   encode: what a description should say, why the summary card must never be used
   to verify one, what not to retrofit, and where the per-repo boundary is.
-- 67 tests over the pure classifiers, using measured false positives as
+- 77 tests over the pure classifiers, using measured false positives as
   reference fixtures.
 
 ### Notes
@@ -69,6 +74,11 @@ First release. Covers the checks that a single repository can answer on its own.
   link to a naive scanner — the first version produced about thirty findings
   against a real repository and every one was noise.
 - Relative links resolve against the file they appear in, not the repo root.
+- Indented text counts as a code block only when a blank line opens it, and then
+  continues while the indent holds. The first rule alone made links inside nested
+  list items invisible; the second alone let everything after a block's first line
+  leak back in. Both were silent false passes, which is worse than noise — the
+  second was caught by the gate on this plugin's own SKILL.md.
 - A README H1 that differs from the repo name is a `WARN`, not an `ERROR`. The
   thread that has to hold is description == catalog == opening line, and the H1
   is none of those three; a human title is a naming choice the operator owns.