fix(kyberforge): catch plugin.json and hooks.json drift in sync-plugin-content.sh --check

--check's throwaway pack copy seeded .claude-plugin/plugin.json and
.github/plugin/plugin.json from the real plugin dir, then packed without
--force -- apm pack silently skips regenerating a plugin.json that already
exists, so the diff always compared the copy against itself and never caught
drift in the compiled name/version/description/mcpServers. --force is now
always passed; in check mode it forces regeneration inside the throwaway copy
only, which sync_plugin_manifest() then diffs against the real committed
manifest.

sync_hooks_json() returned early whenever .apm/hooks/ was missing, without
checking whether a stale hooks.json was still sitting at the plugin root from
a prior sync -- unlike sync_dir(), which already detects that kind of orphaned
mirrored output. It now mirrors sync_dir()'s shape: flagged as drift in
--check, removed on a real sync.

Running the corrected --check --all against this repo's own plugins surfaced
3 real orphans: plugins/{git,gitea,core}/hooks.json, empty stubs added in
4edaaac only to satisfy an old plugin.json pointer-field check that no longer
exists (their compiled plugin.json has never had a hooks field, and none of
the three ever had .apm/hooks/). Removed as part of this fix since they're
exactly the drift the corrected check now catches -- leaving them would break
the sync-plugin-content pre-push gate on this branch.

Also extracts two shared helpers into scripts/lib/, sourced by this script and
others so a future bug fix doesn't need hand-applying three times:
- marketplace-plugins.sh: walks marketplace.json for local plugin dirs (this
  script's --all branch and check-manifests.sh had near-identical copies)
- batch-run.sh: the bounded-batch concurrent job runner (this script,
  tests/run-tests.sh, and tests/run-bats.sh each hand-rolled the same
  core-count-capped wait loop independently)

Extended tests/test-sync-plugin-content.sh with coverage for both drift cases
(plugin.json version-bump drift, orphaned-hooks.json drift), including that a
re-sync clears each.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT

tests/run-bats.sh

@@ -36,27 +36,24 @@ fi
 # of these suites) across files, which is where the wall-clock actually goes.
 # Output is buffered per file so concurrent TAP streams can't interleave, then
 # flushed in stable sorted order once every job has finished.
+#
+# Dispatch and throttling is scripts/lib/batch-run.sh's batch_run -- shared
+# with scripts/sync-plugin-content.sh and tests/run-tests.sh so a batching bug
+# fix only needs to land once; see that file for why this is batched rather
+# than a rolling `wait -n` pool.
 SCRATCH_ROOT="$(mktemp -d)"
 trap 'rm -rf "$SCRATCH_ROOT"' EXIT
+# shellcheck source=../scripts/lib/batch-run.sh
+source "$REPO_ROOT/scripts/lib/batch-run.sh"
 
-# Batches (not a rolling pool) because a bounded rolling pool needs `wait -n`,
-# which is bash 4.3+ and this script is explicitly bash-3.2-safe like
-# run-tests.sh; plain `wait` -- waiting for every job in the current batch --
-# is available since ancient bash. `getconf` over `nproc` for the same
-# reason: `nproc` doesn't exist on macOS.
-JOBS="$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 4)"
-running=0
+declare -a batch_args=()
 i=0
 for f in "${TEST_FILES[@]}"; do
     i=$((i + 1))
-    ( "$BATS" "$f" >"$SCRATCH_ROOT/$i.log" 2>&1; echo $? >"$SCRATCH_ROOT/$i.status" ) &
-    running=$((running + 1))
-    if [[ "$running" -ge "$JOBS" ]]; then
-        wait
-        running=0
-    fi
+    cmd="$(printf '%q %q; echo $? >%q' "$BATS" "$f" "$SCRATCH_ROOT/$i.status")"
+    batch_args+=("$i" "$cmd")
 done
-wait
+batch_run "$SCRATCH_ROOT" ${batch_args[@]+"${batch_args[@]}"}
 
 FAIL=0
 TOTAL_OK=0