fix(kyberforge): catch plugin.json and hooks.json drift in sync-plugin-content.sh --check

--check's throwaway pack copy seeded .claude-plugin/plugin.json and
.github/plugin/plugin.json from the real plugin dir, then packed without
--force -- apm pack silently skips regenerating a plugin.json that already
exists, so the diff always compared the copy against itself and never caught
drift in the compiled name/version/description/mcpServers. --force is now
always passed; in check mode it forces regeneration inside the throwaway copy
only, which sync_plugin_manifest() then diffs against the real committed
manifest.

sync_hooks_json() returned early whenever .apm/hooks/ was missing, without
checking whether a stale hooks.json was still sitting at the plugin root from
a prior sync -- unlike sync_dir(), which already detects that kind of orphaned
mirrored output. It now mirrors sync_dir()'s shape: flagged as drift in
--check, removed on a real sync.

Running the corrected --check --all against this repo's own plugins surfaced
3 real orphans: plugins/{git,gitea,core}/hooks.json, empty stubs added in
4edaaac only to satisfy an old plugin.json pointer-field check that no longer
exists (their compiled plugin.json has never had a hooks field, and none of
the three ever had .apm/hooks/). Removed as part of this fix since they're
exactly the drift the corrected check now catches -- leaving them would break
the sync-plugin-content pre-push gate on this branch.

Also extracts two shared helpers into scripts/lib/, sourced by this script and
others so a future bug fix doesn't need hand-applying three times:
- marketplace-plugins.sh: walks marketplace.json for local plugin dirs (this
  script's --all branch and check-manifests.sh had near-identical copies)
- batch-run.sh: the bounded-batch concurrent job runner (this script,
  tests/run-tests.sh, and tests/run-bats.sh each hand-rolled the same
  core-count-capped wait loop independently)

Extended tests/test-sync-plugin-content.sh with coverage for both drift cases
(plugin.json version-bump drift, orphaned-hooks.json drift), including that a
re-sync clears each.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT

scripts/lib/batch-run.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Shared bounded-batch concurrent job runner. Sourced by
+# scripts/sync-plugin-content.sh, tests/run-tests.sh, and tests/run-bats.sh so
+# their concurrency-cap and per-item log/status handling can't silently
+# diverge -- previously the same batching logic (core-count cap, per-item
+# log/status files, batched `wait`) was hand-implemented independently in all
+# three places.
+#
+# Batches (not a rolling pool) because a bounded rolling pool needs `wait -n`,
+# which is bash 4.3+ -- all three callers are explicitly bash-3.2-safe.
+# `getconf` over `nproc` for the same reason: `nproc` doesn't exist on macOS.
+#
+# Not meant to be executed directly -- source it.
+
+# batch_jobs_limit
+#   Prints the concurrency cap to use for batching.
+batch_jobs_limit() {
+  getconf _NPROCESSORS_ONLN 2>/dev/null || echo 4
+}
+
+# batch_run <scratch_dir> <key1> <cmd1> [<key2> <cmd2> ...]
+#
+# For each key/cmd pair, backgrounds `eval "$cmd"` with its combined
+# stdout+stderr redirected to "<scratch_dir>/<key>.log", bounded to at most
+# batch_jobs_limit concurrent jobs (waiting out the current batch before
+# starting the next).
+#
+# Each <cmd> owns writing its own result to "<scratch_dir>/<key>.status" --
+# this helper only owns dispatch/throttling and log capture, not status
+# semantics. Callers differ on how they do that (capturing $? of an external
+# command with `|| rc=$?`, or a sync function writing its own status flag
+# directly) -- both patterns are preserved as-is by callers, not standardized
+# here, so existing error-handling behavior (including how each pattern
+# interacts with `set -e` in the caller) is unchanged by this extraction.
+batch_run() {
+  local scratch_dir="$1"
+  shift
+  local jobs_limit running key cmd
+  jobs_limit="$(batch_jobs_limit)"
+  running=0
+
+  while [[ $# -gt 0 ]]; do
+    key="$1" cmd="$2"
+    shift 2
+    (eval "$cmd") >"$scratch_dir/$key.log" 2>&1 &
+    running=$((running + 1))
+    if [[ $running -ge $jobs_limit ]]; then
+      wait
+      running=0
+    fi
+  done
+  wait
+}

scripts/lib/marketplace-plugins.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Shared helper: enumerates the local (string-source) plugin entries declared in
+# .claude-plugin/marketplace.json. Sourced by scripts/sync-plugin-content.sh
+# (--all) and scripts/check-manifests.sh so a future marketplace.json schema
+# change (e.g. a new source type) only has to be handled in one place instead
+# of drifting between two hand-maintained copies of the same walk.
+#
+# Requires jq. Not meant to be executed directly -- source it.
+
+# list_marketplace_local_plugins <repo_root> <marketplace_json_path>
+#
+# Prints one "<name>\t<absolute_plugin_dir>" line per local (string `source:`)
+# marketplace entry. Remote sources (github/git/npm objects) have no local
+# directory to walk and are skipped, matching both callers' prior behavior.
+list_marketplace_local_plugins() {
+  local repo_root="$1" marketplace="$2"
+  local plugin_count i name source_type source
+
+  plugin_count="$(jq '.plugins | length' "$marketplace")"
+  for ((i = 0; i < plugin_count; i++)); do
+    source_type="$(jq -r ".plugins[$i].source | type" "$marketplace")"
+    [[ "$source_type" == "string" ]] || continue
+    name="$(jq -r ".plugins[$i].name" "$marketplace")"
+    source="$(jq -r ".plugins[$i].source" "$marketplace")"
+    source="${source#./}"
+    printf '%s\t%s\n' "$name" "$repo_root/$source"
+  done
+}