fix(agentic-engineering): plugin content changes without a version bump, so consumers never refresh #91

🤖 Generated by the Agentic Engineer

Evidence

The agentic-engineering plugin manifest has stayed at version 2.0.0 while the plugin's published content changed underneath it. Concretely, resources/provider-neutral.desired-state.json on the default branch now carries a guardrail line ("Write-capable roles own selected engineering work from claim through exact-head review and merge…") that is absent from a consumer cache installed at 2.0.0 on 2026-07-22. The consumer copy and the default branch agree; only the installed cache is behind, and nothing about its version signals that.

Problem

Runtimes that cache marketplace plugins keyed by version have no reason to re-fetch 2.0.0 once it is installed. Any consumer that adopted the plugin before a content-only change is silently pinned to stale role definitions — agent prompts, skills, and the shipped desired state — with no error and no drift signal.

This directly defeats two properties the shipped desired state declares for itself: updatePolicy: latest-reviewed-default-branch and refreshTiming: before-starting-each-run. Neither is reachable when the only refresh key is a version that does not move. Affected audience is every downstream consumer of this marketplace, not just this deployment.

Expected

A content change to a plugin is accompanied by a version bump, so version-keyed caches refresh; or the marketplace exposes a refresh key that does not depend on the manifest version.

Acceptance criteria

• Publishing a content change to any plugin moves that plugin's manifest version.
• A check fails when a plugin's tracked files change in a commit that leaves its version untouched.
• A consumer on the previous version picks the change up through the normal refresh path, verified end to end rather than by reasoning about the cache.

Rough size: small-to-medium — the enforcement check is the bulk of it.