Make package validation match the resources consumers can load

[devantler]

🤖 Generated by the Agentic Engineer

Evidence and problem

Hands-on production-validator fixtures reproduce six distinct gaps between declared package contents and the resources consumers can actually load. A passing catalogue or manifest comparison must cover regular contained resources, the exact selected agents, complete skill directories and every plugin directory. Literal descriptions and supported MCP names must retain their meaning through validation.

Direction and success signal

Repair the existing package validator rather than add a second package contract. Each linked defect has a positive control and an observable production-gate regression. The success proxy is correct acceptance/refusal for those fixtures, unchanged validation for the current marketplace and green current-head CI/review before merge. No new runtime permissions or automatic-release behavior are introduced.

Acceptance criteria

• The six independently reproduced current defects are corrected and verified through the production gate.
• Prior explicit component-boundary deliveries remain enforced.
• The shipped marketplace validates and all required readiness gates pass before merge.
• The merged command is exercised and linked children record their verified outcomes.

Size: M. Part of #38.