fix(engine): print engine version, so a stale plugin cache is visible

Measured 2026-08-04: two repos (llm-security, config-audit) independently
proved the /repo-standard skill had resolved ${CLAUDE_PLUGIN_ROOT} to a
cached 0.1.1 while 0.2.0 was installed and the catalog pinned it — same
instruction, same variable, wrong engine. 0.1.1 has neither BADGE-COUNT nor
README-LANGUAGE, so a broadcast recommending the skill produced clean-looking
runs that could not have found what they were sent to find.

The header line and --json output now carry `repo-standard v<version>`
(headerLine/withEngineVersion, both pure and unit tested). SKILL.md tells the
reader to confirm it against the catalog pin before trusting green. The
stale-cache resolution itself is the harness's, not this repo's — not fixed
here, only made visible instead of silent.

TDD: 4 new tests. 111/111 green.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01496ZWasKPnA627crFBXWhe

scripts/repo-standard-check.test.mjs

@@ -31,6 +31,8 @@ import {
   parseRepoNameFromRemote,
   extractChangelogTop,
   fetchWithRetry,
+  headerLine,
+  withEngineVersion,
 } from './repo-standard-check.mjs';
 
 const REGISTER = {
@@ -1117,3 +1119,31 @@ test('a non-429 response returns immediately — no retry, no sleep', async () =
   assert.equal(fetchCalls, 1);
   assert.equal(sleepCalls, 0);
 });
+
+// --------------------------------------------------- engine version stamp
+// Measured 2026-08-04: the /repo-standard skill resolved to a cached 0.1.1
+// plugin root while 0.2.0 was installed and the catalog pinned it. Two repos
+// independently proved it by running both engines against the same checkout:
+// 0.2.0 gave 0 WARN, 0.1.1 resurrected the three false positives fixed in
+// v0.1.2/v0.1.3 — and nothing in the output said which engine had run. The
+// header carrying no version is what let a stale engine look like a pass.
+test('headerLine names the engine version, not just the repo status', () => {
+  const line = headerLine({ name: 'voyage', klass: 'plugin', traits: [], status: 'OK' }, '0.2.1');
+  assert.match(line, /voyage/);
+  assert.match(line, /OK/);
+  assert.match(line, /0\.2\.1/);
+});
+
+test('headerLine includes traits when present, same as the unversioned line did', () => {
+  const line = headerLine({ name: 'llm-security', klass: 'plugin', traits: ['security'], status: 'WARN' }, '0.2.1');
+  assert.match(line, /\{security\}/);
+});
+
+test('withEngineVersion adds the version without disturbing existing fields', () => {
+  const result = { name: 'x', klass: 'plugin', status: 'OK', findings: [] };
+  const stamped = withEngineVersion(result, '0.2.1');
+  assert.equal(stamped.engineVersion, '0.2.1');
+  assert.equal(stamped.name, 'x');
+  assert.equal(stamped.status, 'OK');
+  assert.deepEqual(result, { name: 'x', klass: 'plugin', status: 'OK', findings: [] });
+});