feat: add marketplace-architect skill with Bash scripts and evals

Adds a new skill for creating, managing, and adopting plugins across
Claude Code and GitHub Copilot CLI marketplaces. Includes three Bash
scripts (inventory, gen_manifests, validate), three reference docs
(cross-compat, claude-code, copilot-cli), a test harness with 18
passing tests, and an eval.yaml. Also adds the `marketplace` category
to CATEGORIES.md and commits the plugin marketplace architecture
research doc that informed the skill design.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.agents/skills/marketplace-architect/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: marketplace-architect
+description: >
+  Manages and maintains a plugin marketplace for Claude Code and GitHub Copilot CLI.
+  Use this whenever the user wants to: create or update a marketplace (marketplace.json,
+  plugin.json manifests), adopt plugins/skills/agents/hooks from external sources, evaluate
+  cross-tool compatibility between Claude Code and Copilot CLI, plan plugin groupings and
+  boundaries, refactor a repository into marketplace format, validate plugin naming, detect
+  duplicate capabilities, or generate per-plugin install docs — even if they don't use the
+  word "marketplace". Do NOT use when the user wants to author a new skill from scratch
+  (use write-skill), debug an existing skill (use diagnose), or run a direct plugin CLI
+  command (copilot plugin install, claude plugin list).
+metadata:
+  category: marketplace
+---
+
+<requirements>
+
+## Required inputs
+
+- **Target operation** — what the user wants to do; inferred from request. If ambiguous, ask: audit/refactor, adopt an external plugin, update/maintain an existing marketplace, or validate manifests.
+- **Repository path** — path to the repo to act on; defaults to current working directory if not stated.
+- **Marketplace name** — kebab-case identifier (e.g. `my-ai-marketplace`); required only when generating a new `marketplace.json`. Infer from repo name if obvious, ask if not.
+- **Plugin source** — URL, GitHub slug, or local path; required only when adopting an external plugin.
+
+## Constraints
+
+- Load `references/cross-compat.md` before any tool-specific decision — Claude Code and Copilot CLI diverge in ways that cause silent breakage at install time.
+- Never write files until the user has approved the plan at Gate A and the specific file contents at Gate B — two separate explicit approvals required.
+- If credential-shaped content is detected in any manifest field, halt and redirect to environment variable references (e.g. `$MY_TOKEN`) — do not generate the manifest.
+- Produce cross-tool deltas and per-plugin READMEs only when explicitly requested — do not generate them automatically.
+- Scripts in `scripts/` are loaded on demand by the step that needs them — never preloaded.
+- Flag any `../` cross-references in the audited repo before recommending plugin boundaries — plugins cannot reference files outside their own directory after install-time caching.
+- Plugin names must be kebab-case; validate against the reserved name list in `references/claude-code.md` before generating any manifest.
+- Do not set `version` in both `plugin.json` and the marketplace entry — `plugin.json` wins silently and causes update failures.
+
+</requirements>
+
+<steps>
+
+## Process
+
+1. **Identify the operation.** Determine intent from the user's request — one of: (a) audit/refactor a repo into marketplace format, (b) adopt an external plugin/skill/agent, (c) maintain or update an existing marketplace, (d) validate existing manifests. Ask if the operation cannot be inferred.
+
+2. **Load the compatibility reference.** Read `references/cross-compat.md` before any tool-specific decision. Claude Code and Copilot CLI diverge in manifest paths, agent file naming, and hooks layout — every recommendation depends on this table.
+
+3. **Execute the operation phase.**
+
+   **(a) Audit/refactor:** Run `scripts/inventory.sh` against the repo to classify every asset (skill / command / agent / hook / prompt / MCP). Flag any `../` cross-references — these break under install-time caching. Recommend plugin groupings by user outcome (~10–20 plugins); warn if proposed count exceeds 20 or falls below 3. Diff skill descriptions for duplicate capabilities before finalising boundaries. Produce a concrete migration checklist: old path → new path, one row per file.
+
+   **(b) Adopt external plugin:** Fetch and inspect the plugin source. Classify included assets. Check for naming conflicts with existing plugins in the marketplace. Evaluate cross-tool compatibility using `references/cross-compat.md`. Summarise what will be added to `marketplace.json`.
+
+   **(c) Maintain/update:** Read current `marketplace.json` and all `plugin.json` files. Identify stale versions, reserved name violations, kebab-case violations, and `version` duplication between plugin.json and marketplace entry. Report findings as a prioritised fix list.
+
+   **(d) Validate:** Run `scripts/validate.sh` (wraps `claude plugin validate` plus custom JSON and naming checks). Report each violation with a recommended fix. Do not proceed to file writes until all errors are resolved.
+
+4. **Gate A — plan review.** Present the full plan or fix list to the user. Wait for explicit approval before proceeding. Do not interpret silence or "looks good" as approval — require a direct "yes" or equivalent.
+
+5. **Generate outputs.** After Gate A approval: for audit/refactor and adopt operations, run `scripts/gen_manifests.sh` to produce `plugin.json` (at both `.claude-plugin/plugin.json` and plugin root until the Copilot fallback is verified) and `marketplace.json` (at `.claude-plugin/marketplace.json`; optionally mirror to `.github/plugin/marketplace.json`). Read `references/claude-code.md` for Claude-specific path rules and `references/copilot-cli.md` for Copilot-specific requirements.
+
+6. **Gate B — file write approval.** Show the user every file that will be written with its full contents. Wait for explicit approval per file or as a batch. Write nothing until approved.
+
+7. **Validate post-write.** After writes complete, run `scripts/validate.sh` again. Report any remaining issues. Suggest local install test commands: `claude --plugin-dir ./plugins/<name>` and `copilot plugin install ./plugins/<name>`.
+
+8. **Optional deliverables.** Only when the user explicitly asks: emit cross-tool delta notes (what each plugin needs for Copilot vs Claude Code) and per-plugin README with install commands for both tools.
+
+## Output format
+
+Files generated depend on operation:
+- **Audit/refactor and adopt:** `plugin.json` (two locations per plugin until verified), `marketplace.json` (`.claude-plugin/`, optionally `.github/plugin/`), migration checklist as a markdown table
+- **Maintain/update:** updated `marketplace.json` and affected `plugin.json` files
+- **Validate:** report only — no file writes unless explicitly requested after review
+- **Optional:** per-plugin `README.md` with both `claude` and `copilot` install commands
+
+</steps>
+
+<checks>
+
+## Failure handling
+
+- `scripts/inventory.sh` not found or fails — perform manual asset classification using Read and Bash find; note the fallback in output.
+- `scripts/gen_manifests.sh` not found or fails — generate manifest JSON inline; flag that the output was not script-produced.
+- `scripts/validate.sh` not found or `claude plugin validate` unavailable — run manual JSON schema and naming checks using `references/claude-code.md`; flag that automated validation was skipped.
+- Plugin source unreachable (bad URL, private repo, missing path) — stop the adopt operation, report the error, ask the user to verify the source before retrying.
+- Reserved name detected in proposed plugin or marketplace name — halt, report the name and the reserved list from `references/claude-code.md`, ask for a replacement before proceeding.
+- Credential-shaped content detected in any manifest field — halt, do not generate the manifest, redirect to environment variable references.
+
+## Self-check
+
+- [ ] `references/cross-compat.md` loaded before any tool-specific recommendation was made
+- [ ] Operation identified before any scanning or file reading began
+- [ ] Gate A presented and explicit approval received before any manifest was generated
+- [ ] Gate B presented with full file contents and explicit approval received before any file was written
+- [ ] No credential-shaped content in any generated manifest field
+- [ ] All plugin names validated as kebab-case and checked against reserved name list
+- [ ] `version` field not set in both `plugin.json` and marketplace entry for the same plugin
+- [ ] Scripts loaded on demand by step — not preloaded at skill invocation
+- [ ] Cross-tool deltas and READMEs produced only if explicitly requested
+- [ ] Post-write validation run and findings reported
+
+</checks>