[kpal81xd]

Summary

Adds a Plugin job to CI that checks the Claude plugin manifests and the server version the plugin pins. Stacked on #107.

• Validate Claude plugin: runs claude plugin validate plugin --strict with the Claude Code CLI pinned at 2.1.296. It needs no login, and strict mode fails on warnings as well as errors.
• Check plugin version pin: node scripts/check-plugin-pin.mjs reads the three places the plugin pins the server version: version in plugin/.claude-plugin/plugin.json, the @x.y.z in plugin/.mcp.json, and the @x.y.z in the "What it runs" block of plugin/README.md.

Version policy (shared with #105): stable releases move the plugin pin, and beta releases leave plugin/ on the last stable version.

• If package.json has a stable version, all three pins must equal it. A failure names each file that's off, e.g. plugin/.mcp.json pins 0.7.0, expected 0.7.1 from package.json.
• If package.json has a prerelease version (e.g. 0.8.0-beta.0), all three pins must match each other and be a stable version. That way main stays green after a beta release.

The job needs no npm ci and runs in parallel with Build, Lint and Test.

Strict validate checks the plugin manifest only. It doesn't confirm that the pinned npm version exists or that the server starts.

Overlap with #105: #105 adds scripts/sync-plugin-version.mjs, which has a --check mode with similar logic. This check stays separate so the two PRs don't depend on each other. Once both merge, a follow-up can replace this script with sync-plugin-version.mjs --check and remove it.

CI on this PR: ci.yml runs only for pull requests into main, so this stacked PR gets no checks until it's retargeted to main after #107 merges. I ran the validate command and the pin check locally, covering a passing pin, a mismatched .mcp.json, a beta package.json with stable pins, and a stable bump with stale pins.

Closes #106

Manual smoke test

1. Open a PR into main with this change and no other edits. Expected: the Plugin job passes, and the "Check plugin version pin" log shows plugin pinned to 0.7.1 (package.json 0.7.1).
2. Push a commit that changes plugin/.mcp.json to @playcanvas/editor-mcp-server@0.7.0. Expected: "Check plugin version pin" fails with plugin/.mcp.json pins 0.7.0, expected 0.7.1 from package.json.
3. Revert that commit. Expected: the Plugin job passes again.
4. Push a commit that sets package.json version to 0.8.0-beta.0 and leaves the plugin files alone. Expected: the Plugin job passes, because a prerelease keeps the plugin on 0.7.1.
5. Push a commit that also removes description from plugin/.claude-plugin/plugin.json. Expected: "Validate Claude plugin" fails with a description: No description provided warning, which --strict treats as an error.
6. Revert both commits. Expected: the Plugin job passes.