fix(skill-evals): do not scavenge JSON out of a prose step's output

[potiuk]

Summary

Running all 75 eval suites turned up four failures in
security-issue-deduplicate/step-3-merge-body — the whole step, every case.
Reading the model's actual output back, it was correct in all four. The
harness threw it away.

extract_json_from_output's last-resort strategy takes the largest balanced
{...} / [...] block in the CLI's stdout. Ordinary Markdown supplies those
freely: a task-list - [ ] parses as the JSON value [], and a link's
[text] as a malformed one. On a step whose output is prose, that scavenged
fragment replaces the whole body — actual becomes [], raw_output no longer
exists, and every assertion addressing it fails against a correct answer.

What the model actually produced

For case-1-basic-merge, graded as a failure:

## Reporter credited as

- Alice Example
- Bob Researcher

## Security mailing list thread

- Alice Example (initial report): https://lists.apache.org/thread/abc123
- Bob Researcher (redirect-chain vector): https://lists.apache.org/thread/xyz789

Both credits on separate lines, both threads, severity Unknown, the widened
version range, the CWE agreement noted — every assertion satisfied. The reported
failure was field 'raw_output' not present in output.

The fix

A suite whose expected side addresses a wrap key (raw_output, stderr,
exit_code — via expected.json or an assertions.json field) is
declaring that the step emits prose. Skip extraction for those and pass the
body through untouched.

This reuses wrap_is_asserted from #1161 against the mirror-image problem:

#1161	stopped the harness passing what it never graded
this	stops it failing what it graded wrong

Both are the same underlying confusion — treating "no JSON here" as a fact about
the model rather than a fact about the step.

Verification

• All four step-3-merge-body cases pass after the change (0 → 4)
• Two regression tests, both directions: prose containing a task-list stays
  prose; an ordinary JSON step still goes through the extractor
• prek run --all-files passes (exit 0)
• Workspace: pytest, ruff, ruff-format, mypy all green

Version bump

Also bumps the framework to 0.2.0.dev202609081000 and regenerates the
manifests, per marketplace-distribution.md. The marketplace is served from
main and claude plugin update compares version strings, not commit SHAs —
so without a bump, adopters are told they are already up to date and never
receive this fix.

Notes for reviewers

This came out of a full 1196-case run. That run is not finished: 850 cases
returned ERROR from quota exhaustion, not defects — the CLI was healthy when
re-tested. 29 genuine failures remain, clustered in a way that suggests more
shared causes rather than 29 separate bugs (issue-reproducer 7,
issue-fix-workflow 4, audit-finding-fix 3, and two suites failing cases with
matching scope-check / drive-by-reformat names). Those are follow-up work,
not in this PR.

Worth stating plainly: this bug and #1161's were both invisible for as long as
they existed, because each produced a plausible-looking result. The eval harness
needs the same scepticism as the things it grades.

🤖 Generated with Claude Code

https://claude.ai/code/session_01So3JRGXrbqSGrohtZuHWKg