fix(marketplace): honor plugin sources and add Xquik

[kriptoburak]

Summary

• resolve component files from each plugin’s declared source
• keep local sources inside the marketplace repository
• restore generated Git command and Skill descriptions and paths
• add the Xquik remote MCP server, research command, and guarded Skill
• regenerate the marketplace documentation

Independent Fix

The marketplace tooling assumed every plugin lived at plugins/{name}. The git plugin actually lives at plugins/utilities/git, so validation emitted 13 false missing-file warnings. Generated docs also used nonexistent paths and dropped every Git component description.

This change resolves the declared local source in both tools. Three regression tests cover documentation, validation, and path containment.

Closes #3.

Xquik Integration

The new source-native plugin connects Claude Code directly to https://xquik.com/mcp. Claude Code can complete OAuth through /mcp. The bundled command and Skill require route discovery, pagination, source preservation, read-first behavior, explicit write confirmation, billing confirmation, and untrusted-content handling.

Refs #1.

Validation

• python3 -m unittest discover -s tests -v
• tests repeated with Jinja2 available
• Python compilation
• mypy on both marketplace tools and the regression tests
• Ruff error and import checks
• Black check for the new test
• marketplace updater validation with zero warnings
• JSON validation for both manifests
• claude plugin validate .
• Markdown link check
• public MCP guide returned 200
• unauthenticated MCP endpoint returned the expected 401 OAuth challenge
• git diff --check
• required simplify, security, and maintainability reviews