fix(kyberforge): catch plugin.json and hooks.json drift in sync-plugin-content.sh --check

--check's throwaway pack copy seeded .claude-plugin/plugin.json and
.github/plugin/plugin.json from the real plugin dir, then packed without
--force -- apm pack silently skips regenerating a plugin.json that already
exists, so the diff always compared the copy against itself and never caught
drift in the compiled name/version/description/mcpServers. --force is now
always passed; in check mode it forces regeneration inside the throwaway copy
only, which sync_plugin_manifest() then diffs against the real committed
manifest.

sync_hooks_json() returned early whenever .apm/hooks/ was missing, without
checking whether a stale hooks.json was still sitting at the plugin root from
a prior sync -- unlike sync_dir(), which already detects that kind of orphaned
mirrored output. It now mirrors sync_dir()'s shape: flagged as drift in
--check, removed on a real sync.

Running the corrected --check --all against this repo's own plugins surfaced
3 real orphans: plugins/{git,gitea,core}/hooks.json, empty stubs added in
4edaaac only to satisfy an old plugin.json pointer-field check that no longer
exists (their compiled plugin.json has never had a hooks field, and none of
the three ever had .apm/hooks/). Removed as part of this fix since they're
exactly the drift the corrected check now catches -- leaving them would break
the sync-plugin-content pre-push gate on this branch.

Also extracts two shared helpers into scripts/lib/, sourced by this script and
others so a future bug fix doesn't need hand-applying three times:
- marketplace-plugins.sh: walks marketplace.json for local plugin dirs (this
  script's --all branch and check-manifests.sh had near-identical copies)
- batch-run.sh: the bounded-batch concurrent job runner (this script,
  tests/run-tests.sh, and tests/run-bats.sh each hand-rolled the same
  core-count-capped wait loop independently)

Extended tests/test-sync-plugin-content.sh with coverage for both drift cases
(plugin.json version-bump drift, orphaned-hooks.json drift), including that a
re-sync clears each.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT

tests/run-tests.sh

@@ -51,32 +51,24 @@ done < <(
 
 # Each test-*.sh is independent (fixtures live under its own mktemp dir, none
 # write back into the live repo tree -- verified before adding this), so they
-# run concurrently in fixed-size batches instead of one at a time. Batches
-# (not a rolling pool) because a bounded rolling pool needs `wait -n`, which
-# is bash 4.3+ and this script is explicitly bash-3.2-safe (see the hazard
-# scan in test-vale-wrap.sh); plain `wait` -- waiting for every job in the
-# current batch -- is available since ancient bash. `getconf` over `nproc`
-# for the same reason: `nproc` doesn't exist on macOS.
+# run concurrently in fixed-size batches instead of one at a time. Dispatch and
+# throttling is scripts/lib/batch-run.sh's batch_run -- shared with
+# scripts/sync-plugin-content.sh and tests/run-bats.sh so a batching bug fix
+# only needs to land once; see that file for why this is batched rather than a
+# rolling `wait -n` pool.
 SCRATCH_ROOT="$(mktemp -d)"
 trap 'rm -rf "$SCRATCH_ROOT"' EXIT
-JOBS_LIMIT="$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 4)"
+# shellcheck source=lib/batch-run.sh
+source "$REPO_ROOT/scripts/lib/batch-run.sh"
 
-running=0
+declare -a batch_args=()
 idx=0
 for script in ${SCRIPTS[@]+"${SCRIPTS[@]}"}; do
   idx=$((idx + 1))
-  (
-    rc=0
-    bash "$script" >"$SCRATCH_ROOT/$idx.log" 2>&1 || rc=$?
-    echo "$rc" >"$SCRATCH_ROOT/$idx.status"
-  ) &
-  running=$((running + 1))
-  if [[ $running -ge $JOBS_LIMIT ]]; then
-    wait
-    running=0
-  fi
+  cmd="$(printf 'rc=0; bash %q || rc=$?; echo "$rc" >%q' "$script" "$SCRATCH_ROOT/$idx.status")"
+  batch_args+=("$idx" "$cmd")
 done
-wait
+batch_run "$SCRATCH_ROOT" ${batch_args[@]+"${batch_args[@]}"}
 
 idx=0
 for script in ${SCRIPTS[@]+"${SCRIPTS[@]}"}; do