fix: harden plugin creator sharing validation

[efrazer-oai]

Summary

Before this change, the sample plugin creator could emit placeholder-heavy manifests that fail workspace sharing, and it chose a repo-local marketplace implicitly whenever it ran from inside a git checkout.

This PR makes generated plugins share-ready by default. It switches creation to the personal marketplace unless the caller explicitly opts into repo-local paths, adds a validator that mirrors the workspace plugin ingestion contract, and updates the skill prompt and docs to describe the real flow.

The goal is to stop malformed generated plugins before they reach sharing and to make the default placement match the personal marketplace behavior users expect.

Changes

• Generate share-safe plugin manifests instead of [TODO: ...] placeholder payloads.
• Default plugin and marketplace creation to ~/plugins and ~/.agents/plugins/marketplace.json.
• Keep repo-local marketplace creation available through explicit --path and --marketplace-path arguments.
• Add validate_plugin.py to check manifests, companion files, skill frontmatter, skill agent YAML, asset paths, and backend-shaped contracts before sharing.
• Refresh the plugin creator skill text, reference docs, and default prompt to describe validation and the personal default.

Design decisions

• The validator tracks the workspace ingestion schema directly, including the required defaultPrompt alias handling and skill agents/openai.yaml checks.
• The validator keeps one intentional extra preflight rule: leftover [TODO: ...] placeholders are rejected before sharing even when a single placeholder would not independently violate backend type validation.
• Repo-local creation stays possible, but it is now explicit instead of cwd-sensitive.

Testing

Tests: targeted Python syntax checks, plugin skill validation, staged diff whitespace validation, 15 generated plugin smoke runs, backend manifest-schema acceptance for all 15 generated bundles, and a git-repo cwd regression proving the creator still writes to the personal marketplace by default.

[xl-openai]

Maybe we should treat this as a general guidance, not just for sharing?

[efrazer-oai]

Revised!