chore(scripts): isolate HOME and assert exact version in verify-install-simulation (#1490)

Two correctness fixes uncovered while running the script after the
v5.6.2 bump:

1. **HOME isolation** — the subprocess that ran the installed HUD
   inherited the developer's real HOME, so `read_installed_version`
   tier-1 lookup picked up `~/.claude/plugins/installed_plugins.json`
   from the developer machine (5.6.1) instead of the version we are
   about to ship. Output read `CB v5.6.1` even though plugin.json
   was already 5.6.2. The script now passes an explicit `env=` to
   subprocess.run with HOME pointing at the tmpdir.

2. **Fake installed_plugins.json** — Claude Code writes
   `~/.claude/plugins/installed_plugins.json` after every plugin
   install/update, and `hud_version.get_fresh_version` reads it as
   tier 1. The simulation now writes a stub manifest in the isolated
   tmpdir so the installed HUD's version-resolution path matches what
   a real user will hit on first session-start after `/plugin update`.

3. **Exact version assertion** — the script now reads the version
   from `plugin.json`, asserts `CB v<expected_version>` appears in
   the rendered status line, and verifies `~/.claude/hud/.version`
   contains the same value. This auto-tracks bump-version.sh and
   removes the previous risk of shipping a release where the
   version segment renders empty without anyone noticing.

Local verification:
  $ bash packages/claude-code-plugin/scripts/verify-install-simulation.sh
  [verify-install-simulation] stdout='◕‿◕ CB v5.6.2 | Ready 🟢 | $0.42🔥$0.21/m | 2m | 0% | Opus 4.6'
  [verify-install-simulation] PASS: full status line rendered (v5.6.2)
  exit=0

Refs #1490

Author: JeremyDev87

packages/claude-code-plugin/namespace-manifest.json

@@ -34,5 +34,5 @@
       "namespaced": "codingbuddy:plan"
     }
   ],
-  "generatedAt": "2026-04-11T16:03:33.849Z"
+  "generatedAt": "2026-04-11T17:16:02.224Z"
 }

packages/claude-code-plugin/scripts/verify-install-simulation.sh

@@ -65,6 +65,32 @@ settings_file = home / ".claude" / "settings.json"
 settings_file.parent.mkdir(parents=True, exist_ok=True)
 settings_file.write_text("{}")
 
+plugin_root_path = Path(plugin_root)
+
+# Mimic Claude Code's plugin manifest so the installed HUD's tier-1
+# version lookup (read_installed_version → ~/.claude/plugins/installed_plugins.json)
+# resolves to the version we are about to ship. Without this the
+# isolated tmpdir has no installed_plugins.json and the version
+# segment renders empty.
+plugin_json = plugin_root_path / ".claude-plugin" / "plugin.json"
+import json as _json
+expected_version = _json.loads(plugin_json.read_text())["version"]
+plugins_dir = home / ".claude" / "plugins"
+plugins_dir.mkdir(parents=True, exist_ok=True)
+(plugins_dir / "installed_plugins.json").write_text(
+    _json.dumps({
+        "plugins": {
+            "codingbuddy@jeremydev87": [
+                {
+                    "scope": "user",
+                    "installPath": str(plugin_root_path),
+                    "version": expected_version,
+                }
+            ]
+        }
+    })
+)
+
 # Run the installer the same way session-start hook would
 try:
     session_start._install_statusline(home, settings_file)
@@ -103,12 +129,24 @@ payload = json.dumps({
     "model": {"display_name": "Opus 4.6"},
     "cost": {"total_cost_usd": 0.42, "total_duration_ms": 120000},
 })
+# Isolate HOME so the installed script reads the tmpdir installation
+# instead of leaking the developer's real ~/.claude/plugins/installed_plugins.json.
+# Without this, hud_version.get_fresh_version's tier-1 lookup picks up
+# the real machine's plugin version and the assertion below cannot
+# verify that the v5.6.2 prep actually flows through the install path.
+isolated_env = {
+    "HOME": str(home),
+    "PATH": os.environ.get("PATH", ""),
+    "LANG": os.environ.get("LANG", ""),
+    "LC_ALL": os.environ.get("LC_ALL", ""),
+}
 result = subprocess.run(
     ["python3", str(installed_script)],
     input=payload,
     capture_output=True,
     text=True,
     timeout=10,
+    env=isolated_env,
 )
 out = result.stdout
 print(f"[verify-install-simulation] stdout={out!r}")
@@ -129,7 +167,13 @@ if out.strip() == "\u25d5\u203f\u25d5 CodingBuddy":
     )
     sys.exit(1)
 
-required_tokens = ["CB v", "Opus 4.6", "$0.42"]
+# expected_version was resolved earlier from plugin.json so the
+# assertion auto-tracks bump-version.sh.
+required_tokens = [
+    f"CB v{expected_version}",  # version exactly matches plugin.json
+    "Opus 4.6",
+    "$0.42",
+]
 for token in required_tokens:
     if token not in out:
         print(
@@ -138,5 +182,19 @@ for token in required_tokens:
         )
         sys.exit(1)
 
-print("[verify-install-simulation] PASS: full status line rendered")
+# Verify version stamp file
+stamp = home / ".claude" / "hud" / ".version"
+if not stamp.exists():
+    print("[verify-install-simulation] FAIL: .version stamp not written", file=sys.stderr)
+    sys.exit(1)
+stamp_value = stamp.read_text(encoding="utf-8").strip()
+if stamp_value != expected_version:
+    print(
+        f"[verify-install-simulation] FAIL: stamp {stamp_value!r} != "
+        f"plugin.json version {expected_version!r}",
+        file=sys.stderr,
+    )
+    sys.exit(1)
+
+print(f"[verify-install-simulation] PASS: full status line rendered (v{expected_version})")
 PYEOF