chore: drop redundant apm-marketplace-check and Copilot marketplace mirror (findings 1, 2)

apm-marketplace-check checked network reachability of remote marketplace
refs, but finding 35 already removed the only remote package entry, so
every marketplace.packages[] source is local and the hook is pure
overlap with apm-pack-check-clean. apm-audit-ci was re-examined and kept
as-is -- its pre-commit-config.yaml comment already carries a dated,
verified justification the audit had missed.

check-marketplace-mirror-sync guarded .github/plugin/marketplace.json
against drift from .claude-plugin/marketplace.json. Verified against
current GitHub Copilot CLI docs: Copilot's marketplace discovery already
falls back through .github/plugin/marketplace.json to
.claude-plugin/marketplace.json, which this repo generates anyway -- the
dedicated mirror bought a discovery-order preference, not a capability.
Deleted the mirror file, its sync script, its test, and the hook.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YR2CjVumUbEGWcMikcoXBD

docs/spec/architecture.md

@@ -44,7 +44,7 @@ These are routing boundaries, not inventories — they answer "where does a new
 
 Two compilers produce the plugin roots you see in the tree:
 
-- **`apm pack` compiles the manifests** (ADR-0015). Per plugin: `.claude-plugin/plugin.json` and `.github/plugin/plugin.json`, both generated from `plugins/<name>/apm.yml`. Repo-wide, from the root `apm.yml`'s `marketplace:` block: `.claude-plugin/marketplace.json` (apm's `claude` output profile) — the only marketplace output this repo declares. A second root manifest, `.github/plugin/marketplace.json` (Copilot CLI's legacy path), is a byte-identical mirror of the Claude one maintained by `scripts/sync-marketplace-mirror.sh` and gated by the `check-marketplace-mirror-sync` pre-push hook.
+- **`apm pack` compiles the manifests** (ADR-0015). Per plugin: `.claude-plugin/plugin.json` and `.github/plugin/plugin.json`, both generated from `plugins/<name>/apm.yml`. Repo-wide, from the root `apm.yml`'s `marketplace:` block: `.claude-plugin/marketplace.json` (apm's `claude` output profile) — the only marketplace manifest this repo generates or ships. Copilot CLI checks for a marketplace manifest at several conventional paths, falling back through `.github/plugin/marketplace.json` to `.claude-plugin/marketplace.json` — since this repo already generates the latter, no dedicated Copilot-path mirror is maintained.
 - **`scripts/sync-plugin-content.sh` compiles the content mirror** (ADR-0017). It wraps `apm pack --format plugin` and copies the resulting bundle's flat `agents/`, `skills/`, `commands/`, `instructions/`, `extensions/`, and merged `hooks/hooks.json` back to the plugin root. Claude Code's installer convention-scans those flat paths and has no `.apm/` awareness whatsoever, so the mirror exists solely to satisfy the host's discovery contract.
 
 `.apm/` is the sole hand-edited authoring source for plugin content. An edit made in the flat mirror is discarded by the next sync and is reported as drift by the `check-plugin-content-sync` pre-push hook. Hand-authored material that is not an `.apm/` primitive — `README.md`, `docs/`, `bin/`, `sources.md`, `.mcp.json`, and per-plugin extras such as `plugins/gitea/references/` and `plugins/bin/evals/` — lives at the plugin **root** and is untouched by either compiler.

docs/spec/gates.md

@@ -21,24 +21,24 @@ Install hooks via `pc-run`, wiring **all three stages**. This repo's `.pre-commi
 `default_install_hook_types`, so a plain install silently skips `commit-msg` (Conventional Commits)
 and `pre-push` (everything below).
 
-The pre-push command reports **15** hooks, not 13. The extra two are pre-commit's own `meta` hooks,
+The pre-push command reports **13** hooks, not 11. The extra two are pre-commit's own `meta` hooks,
 `check-hooks-apply` and `check-useless-excludes`: they declare no `stages:`, so they run at every
 stage including this one. Both are declared in this repo's `.pre-commit-config.yaml` like everything
-else — what separates them is `repo: meta` (pre-commit's own built-ins) from `repo: local`. Thirteen
+else — what separates them is `repo: meta` (pre-commit's own built-ins) from `repo: local`. Eleven
 is the count of hooks this repo authors itself.
 
-**The caveat: one of those 13 is a silent no-op under that invocation.**
+**The caveat: one of those 11 is a silent no-op under that invocation.**
 `check-release-needed` exits 0 immediately unless `PRE_COMMIT_REMOTE_BRANCH` equals
 `refs/heads/main`, and pre-commit exports that variable only from the real pre-push git hook during
 an actual `git push`. Running the stage by hand — or from a CI runner — therefore reports it
 `Passed` having checked nothing. That is by design for feature branches — pushing WIP must not be
 blocked on cutting a premature tag — but it means `--hook-stage pre-push --all-files` is a full
-rehearsal of 12 hooks and a skip of the thirteenth. The script's own header records the same gap for
+rehearsal of 10 hooks and a skip of the eleventh. The script's own header records the same gap for
 a PR merged through Gitea's merge button, where no local push happens at all.
 
 ## The pre-push gate
 
-Thirteen hooks, grouped below by what they guard rather than by the order `.pre-commit-config.yaml` declares them in.
+Eleven hooks, grouped below by what they guard rather than by the order `.pre-commit-config.yaml` declares them in.
 
 **Core checks**
 
@@ -51,7 +51,6 @@ Thirteen hooks, grouped below by what they guard rather than by the order `.pre-
 | Hook | Guards |
 |---|---|
 | `check-plugin-content-sync` | each plugin's flat `skills/agents/commands/hooks` mirror matches `.apm/` (issue #90) |
-| `check-marketplace-mirror-sync` | `.github/plugin/marketplace.json` is byte-identical to `.claude-plugin/marketplace.json` — no apm output profile targets that path |
 | `check-vale-style-sync` | skill-audit's Vale copy matches agent-audit's canonical copy, plus six glob-coverage probes (see [Vale](#vale)) |
 | `check-scope-walkup-sync` | `validate.sh`, `validate-provenance.sh`, `new-agent.sh` and `new-skill.sh`'s four independent `$HOME`/`.git`/`apm.yml` walk-up ports still agree behaviorally |
 | `check-executables-allow-sync` | root `apm.yml`'s `executables.allow` key names kyberforge's actual version (see [apm gates](#apm-gates)) |
@@ -69,7 +68,6 @@ drift in generated text.
 
 | Hook | Guards |
 |---|---|
-| `apm-marketplace-check` | every `marketplace.packages[]` entry resolves, including network reachability of remote refs |
 | `apm-audit-ci` | `apm audit --ci` once per manifest — root plus each of the six plugin packages |
 | `apm-pack-check-clean` | `apm pack --check-versions --check-clean --dry-run` — the compiled marketplace still matches what `apm.yml` + `.apm/` would generate, and per-package versions agree with the `per_package` strategy |
 
@@ -86,10 +84,10 @@ drift in generated text.
 |---|---|
 | `check-release-needed` | on a real `git push` to `main` only — fails if files exposed via `.pre-commit-hooks.yaml` changed since the last tag. A no-op everywhere else, including under `pre-commit run --hook-stage pre-push` (see [the caveat above](#running-the-gates)) |
 
-Four of these shell out to `apm`: `apm-marketplace-check`, `apm-audit-ci`, `apm-pack-check-clean`,
-and `check-plugin-content-sync` (via `scripts/sync-plugin-content.sh`, which wraps `apm pack`). The
-first and third are bare `apm …` entries and the second is a `bash -c` loop calling `apm` once per
-package, so without the CLI the push dies with an unhelpful "command not found". Install with
+Three of these shell out to `apm`: `apm-audit-ci`, `apm-pack-check-clean`, and
+`check-plugin-content-sync` (via `scripts/sync-plugin-content.sh`, which wraps `apm pack`). The
+second is a bare `apm …` entry and the first is a `bash -c` loop calling `apm` once per package, so
+without the CLI the push dies with an unhelpful "command not found". Install with
 `apm-install`, or `curl -sSL https://aka.ms/apm-unix | sh`; verify with `apm --version`. `jq` is
 needed by `scripts/sync-plugin-content.sh` — it at least fails loudly (`Error: jq is required but
 not installed`).
@@ -889,8 +887,7 @@ fix.
 ## Pushing without a network
 
 No pre-push hook needs the network. Every entry in root `apm.yml`'s `marketplace.packages[]`
-resolves from a local `./plugins/<name>` path, so `apm-marketplace-check` and `apm-pack-check-clean`
-never call `git ls-remote`.
+resolves from a local `./plugins/<name>` path, so `apm-pack-check-clean` never calls `git ls-remote`.
 
 `apm-audit-ci` calls `apm` too but was always local: its org-policy discovery resolves nothing on
 this remote before any network call.