Fix and CI-gate the stale .cursor-plugin/plugin.json manifest

[TMHSDigital]

Context / Problem Statement

.cursor-plugin/plugin.json is pinned at "version": "0.2.3" while the repo is at v0.5.0 (VERSION). It lists only the skills (12) and rules (6) arrays and omits snippets, templates, and examples entirely. No job in .github/workflows/validate.yml checks the manifest against the filesystem, so it has drifted silently. Consumers that read the manifest see a v0.2.0-era view of the pack.

Proposed Solution / Implementation Steps

1. Decide the manifest schema for snippets/templates/examples (mirror the existing relative-path-array style used for skills/rules). If the upstream cursor-plugin schema only supports skills+rules, document that and instead just fix version + add the gate.
2. Update .cursor-plugin/plugin.json: bump version to match VERSION, and add the missing arrays enumerating files under snippets/, templates/, examples/.
3. Add a validate-manifest job to validate.yml (a python3 heredoc like the existing validate-counts job) that:
   • loads plugin.json,
   • asserts every path in each array exists on disk,
   • asserts every skills/*/SKILL.md and rules/*.mdc on disk is present in the manifest,
   • asserts plugin.json version equals VERSION (or is intentionally decoupled — pick one and enforce it).
4. If version should track releases, add it to the release-doc-sync owned-lines list so the release pipeline rewrites it; otherwise document why it is independent in AGENTS.md.

Definition of Done

• plugin.json enumerates all current skills, rules, snippets, templates, examples.
• plugin.json version reconciled with VERSION (synced or documented as independent).
• New CI job fails on any manifest↔filesystem mismatch (proven by a deliberately broken commit).
• AGENTS.md "CI/CD workflows" section documents the new job.

---

Filed from the repository technical audit — see docs/technical-audit.md.