ci: guard README plugin table ↔ filesystem parity (un-guarded twin of the manifest parity checks) #31

🤖 Generated by the Daily AI Assistant

Problem

The repo guards every machine-facing parity invariant in scripts/validate-manifests.sh
(both marketplace manifests valid + in sync, each plugins/<name>/plugin.json complete,
and manifest ↔ on-disk-plugins lockstep — see #25, #30). But the human-facing
README.md plugin table (Plugin | Skills | Description) is a third representation
of the same facts and is completely un-guarded:

• A plugin added or removed under plugins/ is enforced against the manifests and
  filesystem, but the README table can silently drift.
• The README Skills column lists each plugin's bundled skills by name. Adding or
  removing a plugins/<name>/skills/<skill>/ directory does not update that list, so
  it drifts independently of disk with no CI signal — the most likely real-world drift
  (skills change more often than plugins).

This is the classic un-guarded twin: the parity family enforces N of M
representations, and the README is the one left unchecked.

Proposed direction

Extend scripts/validate-manifests.sh with a validate_readme_parity check (and mirror
it in validate-manifests.test.sh), keeping the single-source-of-truth + self-test
pattern — no new CI job needed (the existing validate-manifests + lint-scripts jobs
pick it up):

1. Plugin-name parity — every plugins/<name>/ appears as a README table row, and
   every README plugin row resolves to an on-disk plugin (no missing/orphan rows).
2. Per-plugin skills-set parity — the backticked skill names in each row's Skills
   column equal the set of plugins/<name>/skills/<skill>/ directories on disk.

The Description column stays editorial (free prose) — not validated (plugin.json
description ↔ manifest is already guarded).

Verified the current README.md already satisfies both checks for all 6 plugins, so the
guard passes today and only fails on future drift.

Rough size

XS–S — one bash function + a fixture-README extension and ~3 new self-test cases
(missing row, skills-set drift, README-lists-nonexistent-plugin). Behaviour-preserving,
additive, no runtime change.