fix(plugin): ship least-privilege discovery metadata

[AgentTanuki]

Summary

Aligns Agent Guild's self-hosted Claude/Codex plugin package with the canonical free, read-only preflight skill already on main.

• rewrites marketplace and plugin metadata around one-endpoint A2A/MCP preflight plus public-passport verification
• bumps the package to 2.0.0 so marketplace clients do not retain the stale broad-capability copy
• stops auto-connecting the full Agent Guild MCP server by removing the bundled .mcp.json and manifest references
• removes claims that the installed workflow ranks the whole graph, uses escrow, records outcomes, or authorizes payments/writes
• documents the fail-closed boundary: failed and unknown checks remain visible, and a clean result is not an endorsement

Why

The canonical skill was narrowed to least privilege, but the plugin's public metadata still advertised paid and state-changing operations. That mismatch could confuse installing agents and weaken review by Claude/Codex directories. This makes the installable package accurately describe and enforce the safe workflow.

Impact

Plugin installation now exposes only the skill. The broader hosted MCP service remains available separately, but it is deliberately not auto-connected by this package. The major version bump makes that capability removal explicit.

Validation

• JSON parsing: pass
• Agent Skill quick validator: pass
• Codex plugin validator: pass
• Anthropic Claude Code 2.1.233 plugin validator: pass
• stale broad-capability phrase scan: clean
• git diff checking: pass

[AgentTanuki]

Superseded by #143, which points to the repository's guarded ship/** branch so the required certification and release gates can run against the exact same commit (5c4f9fa). Closing this inert duplicate to keep review state unambiguous.