better ci validations, fix marketplace error

[GrosQuildu]

bats fails because plugins/gh-cli/hooks is now linted - need to fix the hooks in another PR

[dguido]

Code Review Summary

Reviewed with: security-sentinel, architecture-strategist, pattern-recognition-specialist, performance-oracle, code-simplicity-reviewer

Findings by Severity

Severity	Count	Fixed	Dismissed
P2 (Important)	3	3	0
P3 (Nice-to-have)	5	1	4
Total	8	4	4

Fixed (P2)

1. Dead CHANGED_FILES code path — extract_plugins_from_changed_files(), PLUGIN_PATH_PATTERN, os import, and the branching in main() were unreachable since no workflow sets CHANGED_FILES. Removed ~25 lines.
2. Duplicate plugin.json reads — Both validate_plugin_json() and validate_marketplace_entry() independently opened and parsed plugin.json. Added parse_plugin_json() to read once, pass the result to both validators.
3. Missing version/description consistency checks — validate_marketplace_entry() checked name and source but not version or description. Added both checks. Also synced 5 pre-existing mismatches in marketplace.json (second-opinion version 1.0.0→1.2.0, plus description drifts in ask-questions-if-underspecified, burpsuite-project-parser, fix-review, insecure-defaults).

Fixed (P3)

4. Bats find | xargs not space-safe — Changed to find -print0 | xargs -0 --no-run-if-empty bats.

Dismissed (P3)

5. Shellcheck severity downgrade — Intentional change by PR author (warning→info is reasonable for CI).
6. ValidationError as dataclass vs namedtuple — Dataclass is fine here; namedtuple would save negligible memory with no readability benefit.
7. Missing unit tests for validation script — Valid observation but out of scope for this PR. The script is exercised by CI on every push.
8. Silent failures on missing config files — parse_marketplace() etc. returning empty on missing files is correct behavior (graceful degradation for repos without all config files).

Quality Pipeline

• ruff check: passed
• ruff format: passed
• pre-commit hooks: all passed
• validate_plugin_metadata.py: all registered plugins pass (local-only dirs humanizer/skill-extractor correctly flagged)