Version plugin and package independently, released by CI

[ubyndr]

Brings over the release process tested in atlas-skills-sandbox.

What changes

• Separate tags. The plugin tags as cap-tools--v<version> and the package as pkg-cap-client--v<version>. Skills now pin pkg-cap-client--v0.4.0, and cap-tools moves to 0.4.1.
• scripts/versions.py, from the sandbox, tested in tests/test_versions.py:
  • check-bumps: fails a PR that changes the plugin or package without bumping its version
  • untagged: lists what the release job should tag
  • pins: lists every package pin in use
  • report: generates docs/pins.md
  • cli <dir> [--at REF] (new here): cap-client installs cap, not a command named after its directory, so the workflows read the command name from pyproject.toml, at the pinned tag.
• test.yml adds: plugin validation, a bump check on PRs, a check that docs/pins.md is current, install-from-git on PRs as well as main, and a run of every skill pin exactly as written.
• release.yml (new): once test is green on main, tags untagged packages, then plugins (via claude plugin tag), and creates a GitHub Release for each. It sets permissions: contents: write itself, so the org's read-only default doesn't block it. The sandbox works the same way.
• nightly.yml (new): re-installs every pin used by main and the last 3 plugin releases, and runs the package's tests at each pinned tag. uvx --from git+… resolves dependencies fresh and ignores uv.lock, so a tag can stop working without any new commit.
• Smaller fixes:
  • deleted the stale, unused packages/cap-client/uv.lock, and made uv.lock exempt from the bump check
  • the README example pinned v0.3.0
  • the README claimed a committed enabledPlugins needs no install step; each person still runs claude plugin install once
  • the README now covers pinning a release by ref, plus the one-registration-per-machine caveat

Already done

8 backfill tags are pushed: cap-tools--v0.1.0…v0.4.0 and pkg-cap-client--v0.1.0…v0.4.0. Each is an alias at the same commit as the existing vX.Y.Z tag, which stay in place, and old pins still resolve. uvx --no-cache --from …@pkg-cap-client--v0.4.0 … cap --version prints cap-client 0.4.0.

After merge

release should create only cap-tools--v0.4.1, with no package tag. Then run nightly once via workflow_dispatch to confirm it is green.

Local checks

./dev.sh passes: 145 package and grader tests, 28 tooling tests, docs/pins.md current, plugin validation. check-bumps --base origin/main passes and ruff is clean.

🤖 Generated with Claude Code