feat(agent-skills): marketplace.json build, validate, and audit

[jdutton]

Summary

• Add MarketplaceManifestSchema (Zod, passthrough) supporting all official source types (string, github, url, npm, pip)
• Add validateMarketplace() validator mirroring the plugin-validator pattern
• Generate marketplace.json in vat claude build with relative source paths
• Validate marketplace.json in vat claude verify against the schema
• Route marketplace type through unified validator, replacing the placeholder UNKNOWN_FORMAT error
• Make plugin description optional in VAT project config (adopter compatibility)
• Add marketplace-level skills selector to config schema

Verification

• Schema verified against official Anthropic docs and real-world fixtures (claude-plugins-official, anthropic-agent-skills, superpowers)
• Tested in avonrisk-sdlc adopter project — vat build + vat verify both pass
• vat audit --user now correctly validates 4 marketplaces (previously returned UNKNOWN_FORMAT)
• All 14 validation steps pass across 3 phases (build, integration, system tests)

Test plan

• bun run validate passes (14/14 steps)
• New unit tests: marketplace-manifest.test.ts (13 tests), marketplace-validator.test.ts (5 tests)
• Updated existing tests: unified-validator, audit integration, audit system tests
• Dogfood: vat build --cwd packages/vat-development-agents generates marketplace.json
• Dogfood: vat verify --cwd packages/vat-development-agents validates it
• Adopter: VAT_ROOT_DIR=. vat build in avonrisk-sdlc succeeds
• Adopter: VAT_ROOT_DIR=. vat verify in avonrisk-sdlc passes all phases
• vat audit --user shows no UNKNOWN_FORMAT for marketplace directories

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.35%. Comparing base (ae7bd64) to head (4443891).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #57      +/-   ##
==========================================
+ Coverage   74.22%   74.35%   +0.13%     
==========================================
  Files         164      165       +1     
  Lines       12315    12379      +64     
  Branches     2173     2187      +14     
==========================================
+ Hits         9141     9205      +64     
  Misses       3174     3174              

Files with missing lines	Coverage Δ
...ent-skills/src/validators/marketplace-validator.ts	100.00% <100.00%> (ø)
...s/agent-skills/src/validators/unified-validator.ts	64.28% <100.00%> (-5.42%)	⬇️

Files with missing lines	Coverage Δ
...ent-skills/src/validators/marketplace-validator.ts	100.00% <100.00%> (ø)
...s/agent-skills/src/validators/unified-validator.ts	64.28% <100.00%> (-5.42%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud