fix(kyberforge): harden plugin-content sync, reinject Copilot mcpServers

PR #95's review of the issue #90 apm-conversion work found several
defects in scripts/sync-plugin-content.sh and the gate wired to it:

- --check claimed never to mutate the plugin root, but apm pack still
  wrote .claude-plugin/plugin.json and .github/plugin/plugin.json into
  the real plugin_dir on first-time creation. --check now packs a
  throwaway copy instead.
- check-plugin-content-sync hardcoded the six plugin directories
  instead of deriving them the way check-manifests.sh already does.
  Added an --all flag that parses .claude-plugin/marketplace.json, and
  simplified the pre-commit hook to use it.
- A missing plugin_dir and one that legitimately has no .apm/ yet both
  reported SKIP/success; a missing directory now FAILs.
- The dispatch loop backgrounded every plugin with no concurrency cap,
  unlike the JOBS-bounded pattern this same PR added to
  tests/run-bats.sh and tests/run-tests.sh. Added the same
  bash-3.2-safe getconf + batched-wait cap here for consistency.
- Per-plugin scratch/log/status files were keyed only by basename, with
  no collision guard across arguments; added a fail-fast check.
- sync_hooks_json()'s trailing-newline normalization was duplicated
  between its --check and write branches; factored into one helper.
- tests/test-sync-plugin-content.sh set two competing `trap ... EXIT`
  statements, so the first (cleaning up $FIXTURE) was silently
  replaced by the second and its tmp dir leaked every run. Adopted the
  track()/CLEANUP_DIRS pattern already used in
  tests/test-check-release-needed.sh.

Separately: apm's Copilot-ecosystem plugin.json builder unconditionally
strips mcpServers, citing (in its own docstring) that the field is out
of schema for Copilot -- a claim this repo's own researched Copilot
plugin schema docs contradict. reinject_mcp_servers() narrowly restores
it from the plugin's .mcp.json on real syncs only, regenerating
plugins/bin/.github/plugin/plugin.json (the only plugin that currently
declares any MCP servers). Documented as an amendment to ADR-0017,
since it's a deliberate, narrow exception to that ADR's rejection of
patching apm's compiled output -- apm's premise for stripping
skills/agents/commands/hooks pointers is still accurate; its premise
for stripping mcpServers is not.

All 12 assertions in tests/test-sync-plugin-content.sh pass
individually, plus 5 new regression tests added for this round; the
full bats and shell-script suites are green; shellcheck is clean.

Refs: #95
ADR: 0017

docs/adr/0017-plugin-content-mirror-bridges-apm-to-host-discovery.md

@@ -107,6 +107,37 @@ source and scans directories; it does not execute a package manager's build comm
 Copying the relevant subset back to the stable `plugins/<name>/` path — where `marketplace.json`
 already points — needed no change to the marketplace source model at all.
 
+## Amendment (2026-08-13): `mcpServers` is narrowly reinjected into Copilot's `plugin.json`
+
+PR #95's review (a follow-on to this same issue #90 workstream) found a second field apm's
+compiler strips for the Copilot ecosystem: `build_plugin_manifest` unconditionally removes
+`mcpServers` from every Copilot-ecosystem `plugin.json`, its docstring stating the field is "not
+part of the Copilot plugin manifest schema." That claim is contradicted by this repo's own
+researched documentation — `plugins/kyberforge/docs/research/docs/github-copilot-plugins/
+configuration.md:49` documents `mcpServers` as a valid, optional `plugin.json` field for Copilot.
+
+This is not the same situation "Considered options" above rejected. That rejection concerned
+fields apm strips *correctly*, on a stable and accurate premise: convention directories
+(`skills/`, `agents/`, `commands/`) are host-auto-discovered, so an explicit pointer is redundant
+by design. Here, apm's own stated justification for stripping `mcpServers` is factually wrong
+against documented Copilot behavior — there is no host-auto-discovery mechanism that makes an
+explicit `mcpServers` declaration redundant, the way there is for skills/agents/commands. Applying
+the same "don't fight a stable, intentional apm code path" reasoning here would mean shipping a
+plugin manifest known to be missing a field Copilot actually reads.
+
+Given that, `scripts/sync-plugin-content.sh`'s `reinject_mcp_servers()` (line 190, called from
+`sync_one()` at line 269, real syncs only) narrowly re-injects `mcpServers` into
+`.github/plugin/plugin.json` after a real sync, sourced from the plugin's own `.mcp.json`, and
+only when it declares at least one server — matching apm's own Claude-ecosystem builder, which
+omits the field entirely rather than emitting `mcpServers: {}`. This is scoped to one field found
+to be incorrectly stripped, not a reversal of the broader position above: the rejection of
+patching `skills`/`agents`/`commands`/`hooks` pointers still holds, since apm's premise for
+stripping those remains accurate.
+
+Consequence: if a future apm release corrects the Copilot `mcpServers` omission, `reinject_mcp_servers()`
+and its call site become dead code and should be deleted — nothing else in this ADR depends on the
+reinjection existing beyond working around this specific upstream gap.
+
 ## Consequences
 
 - Git now tracks real, visible duplication: `.apm/skills/<name>/SKILL.md` and