plugins: distribute via npx plugins add; CI verifies Claude Code + Codex

[jbragg]

Distribute asta plugins via npx plugins add

Enables two things:

1. Full plugins into any agent the installer supports — whole plugins
   (skills + hooks) via the agent's native plugin system, not just loose skill
   files (npx skills add) or Claude Code's own marketplace.
2. One canonical source, reduced duplication — plugins/asta-preview/ now
   holds the skills (edit here); plugins/asta is generated as the core subset.
   Only those 5 core skills are still duplicated, down from the old layout where
   a top-level skills/ was copied into both plugin dirs.

No skill/hook content changes. The shipped plugin trees are byte-identical
to main — SKILL.md, assets, scripts, workflows, and hooks. The PR deletes the
now-redundant top-level skills/+hooks/ (duplicates of the plugin copies — so
the diff shows deletions, not renames) and makes plugins/asta-preview the
canonical source. Verify (empty diff = identical):

$ git diff main HEAD -- plugins/asta plugins/asta-preview
                       # (no output)
$ git diff --stat main HEAD -- plugins/
 plugins/README.md | 29 +++++++++++++++++++++-----   # the only changed file

Layout, rationale, and the distribution matrix are in the DEVELOPER.md diff.
Install is verified in CI with no auth (plugin-install job). The verifier runs
under a throwaway HOME, so bash scripts/verify-plugin-install.sh <agent> is
safe to run locally too (needs claude/codex on PATH).

Tests. The split is asserted from the filesystem (TestPluginLayout);
CLI-based tests are thin smokes that our repo is consumable by the real
installers. Removed the npx skills --list discovery test — it re-checked the
CLI's own discovery and coupled to its output wording (vercel's to test, not
ours), and the install smoke now asserts the same exact set via real install.
CLI smokes run against @latest — what npx plugins add / npx skills add
actually give users — so green means users can install, and an upstream break
reds CI immediately (the SKILLS_CLI/PLUGINS_CLI env vars pin as an emergency
lever). New guards (in the diff) cover our own contract — marketplace sources
resolve, no committed per-plugin manifest, metadata.internal is boolean.

Not derivable from the diff: inspect-swe is unaffected — -S skills=
resolves plugins/asta-preview/skills (kept), now guarded by the docker smoke
test. Companion agent-baselines PR (allenai/agent-baselines#28):
points the inspect-swe swap-in-local-skills recipe at the now-canonical
plugins/asta-preview/skills (edit it directly). Land alongside this PR.

[rodneykinney]

Hooray!