fix(scripts): close gates that passed while the thing they guard was disabled

Four repo gates reported success in states they exist to reject.

`check-vale-style-sync.sh` passed while a Kyberforge lint rule was silenced. The
check matched a blocklist of severity values, but Vale's semantic is an allowlist:
anything that is not exactly YES/error/warning/suggestion disables the rule. So
`= false`, `= 0`, `= garbage`, an empty value and — worst — a lowercase `= yes` all
killed enforcement while reading as "enabled" to a human. Inverted to an allowlist.
Two sibling holes: dropping `KyberforgeCopilot` from `BasedOnStyles` unloaded the
Copilot-only check silently, and narrowing a section glob to a location made Vale
lint zero files, which is the "0 files, hook Passed" failure the script's own
comment says it exists to catch.

`sync-marketplace-mirror.sh --check` failed open when its source was missing, while
its sibling correctly errored in the same state.

`check-scope-walkup-sync.sh` wrote to hardcoded `/tmp/fN.out` paths and read one
back, making it non-reentrant — a concurrent instance can flip a verdict, and this
branch made the test runner concurrent. Now per-run `mktemp -d`.

`check-manifests.sh` had no disk-to-marketplace pass, so a plugin directory absent
from `marketplace.json` passed every gate while the `validate-plugins` hook globbed
it. The "listed" match is restricted to remote-source entry names; matching any
entry name let a genuine orphan through on a name coincidence.

`run-bats.sh` reported an empty TAP stream as `0 tests, 0 failures`, exit 0 — a
total harness failure reading as a pass.

The test-side changes are the larger half, because the guards were the real problem.
`test-sync-marketplace-mirror.sh` could overwrite the live tracked mirror under an
inherited GIT_DIR, which is precisely the git-hook context it runs in. The bash-3.2
scan hand-maintained its file list, omitting the new shared runner, and had no rule
for `wait -n` or `nproc` — the two hazards the previous review round found live. It
now derives 43 files across three globs with per-glob floors. Several assertions
were decoration: the concurrency checks caught the reentrancy defect 0 times in 10,
the leak fix was green either way, and two manifest fixtures passed with the code
they claimed to cover deleted. Every assertion now has a revert it provably fails
against.

Refs: #90

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT

scripts/check-manifests.sh

@@ -19,6 +19,16 @@ set -euo pipefail
 # those paths resolve. The fallback block below restores that check, but only for
 # plugins without .apm/ -- apm-native plugins keep relying on the delegation above so
 # the two checks don't duplicate (and disagree) on the same manifest.
+#
+# Both of the above walk marketplace.json -> disk. Nothing walked disk -> marketplace,
+# so a plugins/<name>/ directory that never made it into marketplace.json was invisible
+# to every marketplace-derived gate at once (this script and sync-plugin-content.sh
+# --all both derive their plugin set from marketplace.json). The final block below
+# closes that direction: per ADR-0015 marketplace.json is compiled output of root
+# apm.yml's marketplace.packages[], so an on-disk apm package with no entry is
+# compiled-output drift of exactly the kind ADR-0017 wires pre-push gates for -- and it
+# is the same plugin set the validate-plugins pre-commit hook already globs as
+# plugins/*/.
 
 REPO_ROOT="${1:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
 FAIL=0
@@ -39,6 +49,11 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=lib/marketplace-plugins.sh
 source "$SCRIPT_DIR/lib/marketplace-plugins.sh"
 
+# Every local plugin directory marketplace.json claimed, canonicalized, so the
+# disk -> marketplace pass below can tell "listed" from "unlisted" regardless of how
+# the `source:` string was spelled (./plugins/x, plugins/x, plugins/x/).
+SEEN_PLUGIN_DIRS=()
+
 while IFS=$'\t' read -r name plugin_dir; do
   source_rel="${plugin_dir#"$REPO_ROOT"/}"
 
@@ -46,6 +61,9 @@ while IFS=$'\t' read -r name plugin_dir; do
     err "plugin '$name': source directory not found: $source_rel"
     continue
   fi
+  # -P so a plugin directory reached through a symlink compares equal to the same
+  # directory reached directly; the disk-side walk below resolves the same way.
+  SEEN_PLUGIN_DIRS+=("$(cd "$plugin_dir" && pwd -P)")
 
   manifest="$plugin_dir/.claude-plugin/plugin.json"
   if [[ ! -f "$manifest" ]]; then
@@ -80,6 +98,59 @@ while IFS=$'\t' read -r name plugin_dir; do
   done
 done < <(list_marketplace_local_plugins "$REPO_ROOT" "$MARKETPLACE")
 
+# Disk -> marketplace. The trigger is any of the three markers that make a directory
+# a plugin rather than scratch -- apm.yml (the ADR-0015 authoring source), .apm/ (its
+# content tree), or a compiled .claude-plugin/plugin.json. Matching all three keeps
+# this set aligned with the plugins/*/ glob the validate-plugins pre-commit hook uses,
+# which is the disagreement this check exists to close; a directory with none of them
+# is scratch and stays out of scope.
+#
+# A candidate counts as listed if it is either a directory some local entry pointed at
+# (path match, canonicalized above) or a directory whose name matches a REMOTE entry's
+# name. The name axis exists only for a plugin vendored on disk but declared with the
+# remote-object `source:` shape: list_marketplace_local_plugins deliberately skips those,
+# so a path-only match would report a missing entry that is in fact already there.
+#
+# It is restricted to non-string sources on purpose. Applied to local entries too, the
+# name axis silently rescues genuine orphans, because a local entry's name need not equal
+# the basename of the directory it points at: an entry named "beta" pointing at
+# ./plugins/alpha would mark an unrelated, entirely unlisted plugins/beta/ as listed.
+# Local entries already have an exact path to match on, so they need no name fallback.
+MARKETPLACE_NAMES=()
+while IFS= read -r entry_name; do
+  [[ -n "$entry_name" ]] && MARKETPLACE_NAMES+=("$entry_name")
+done < <(jq -r '.plugins[]? | select((.source | type) != "string") | .name // empty' "$MARKETPLACE")
+
+for candidate in "$REPO_ROOT"/plugins/*/; do
+  candidate="${candidate%/}"
+  [[ -d "$candidate" ]] || continue
+  if [[ ! -f "$candidate/apm.yml" && ! -d "$candidate/.apm" && ! -f "$candidate/.claude-plugin/plugin.json" ]]; then
+    continue
+  fi
+
+  candidate_abs="$(cd "$candidate" && pwd -P)"
+  candidate_name="$(basename "$candidate")"
+  listed=0
+  for seen in ${SEEN_PLUGIN_DIRS[@]+"${SEEN_PLUGIN_DIRS[@]}"}; do
+    if [[ "$seen" == "$candidate_abs" ]]; then
+      listed=1
+      break
+    fi
+  done
+  if [[ $listed -eq 0 ]]; then
+    for entry_name in ${MARKETPLACE_NAMES[@]+"${MARKETPLACE_NAMES[@]}"}; do
+      if [[ "$entry_name" == "$candidate_name" ]]; then
+        listed=1
+        break
+      fi
+    done
+  fi
+
+  if [[ $listed -eq 0 ]]; then
+    err "plugin directory '${candidate#"$REPO_ROOT"/}' has no entry in .claude-plugin/marketplace.json — it is skipped by every marketplace-derived check (this one, and sync-plugin-content.sh --all) while still being globbed by the validate-plugins hook. Add it to root apm.yml's marketplace.packages[] and recompile the manifests."
+  fi
+done
+
 if [[ $FAIL -gt 0 ]]; then
   echo "Manifest check failed: $FAIL error(s)" >&2
   exit 1