chore(sync): apply remaining canonical fleet drift fixes

Author: jdalton

.config/oxfmtrc.json

@@ -64,7 +64,6 @@
     "**/scripts/ai-lint-fix.mts",
     "**/scripts/ai-lint-fix/cli.mts",
     "**/scripts/ai-lint-fix/rule-guidance.mts",
-    "**/scripts/check-lock-step-refs.mts",
     "**/scripts/check-paths.mts",
     "**/scripts/check-paths/allowlist.mts",
     "**/scripts/check-paths/cli.mts",
@@ -78,6 +77,7 @@
     "**/scripts/check-paths/walk.mts",
     "**/scripts/check-prompt-less-setup.mts",
     "**/scripts/fix.mts",
+    "**/scripts/install-claude-plugins.mts",
     "**/scripts/install-git-hooks.mts",
     "**/scripts/install-sfw.mts",
     "**/scripts/lint-github-settings.mts",

.config/oxlintrc.json

@@ -155,7 +155,6 @@
     "**/scripts/ai-lint-fix.mts",
     "**/scripts/ai-lint-fix/cli.mts",
     "**/scripts/ai-lint-fix/rule-guidance.mts",
-    "**/scripts/check-lock-step-refs.mts",
     "**/scripts/check-paths.mts",
     "**/scripts/check-paths/allowlist.mts",
     "**/scripts/check-paths/cli.mts",
@@ -169,6 +168,7 @@
     "**/scripts/check-paths/walk.mts",
     "**/scripts/check-prompt-less-setup.mts",
     "**/scripts/fix.mts",
+    "**/scripts/install-claude-plugins.mts",
     "**/scripts/install-git-hooks.mts",
     "**/scripts/install-sfw.mts",
     "**/scripts/lint-github-settings.mts",

.gitattributes

@@ -124,6 +124,11 @@
 .claude/hooks/markdown-filename-guard/package.json linguist-generated=true
 .claude/hooks/markdown-filename-guard/test/index.test.mts linguist-generated=true
 .claude/hooks/markdown-filename-guard/tsconfig.json linguist-generated=true
+.claude/hooks/marketplace-comment-guard/README.md linguist-generated=true
+.claude/hooks/marketplace-comment-guard/index.mts linguist-generated=true
+.claude/hooks/marketplace-comment-guard/package.json linguist-generated=true
+.claude/hooks/marketplace-comment-guard/test/index.test.mts linguist-generated=true
+.claude/hooks/marketplace-comment-guard/tsconfig.json linguist-generated=true
 .claude/hooks/new-hook-claude-md-guard/README.md linguist-generated=true
 .claude/hooks/new-hook-claude-md-guard/index.mts linguist-generated=true
 .claude/hooks/new-hook-claude-md-guard/package.json linguist-generated=true
@@ -448,7 +453,6 @@ packages/build-infra/release-assets.schema.json linguist-generated=true
 scripts/ai-lint-fix.mts linguist-generated=true
 scripts/ai-lint-fix/cli.mts linguist-generated=true
 scripts/ai-lint-fix/rule-guidance.mts linguist-generated=true
-scripts/check-lock-step-refs.mts linguist-generated=true
 scripts/check-paths.mts linguist-generated=true
 scripts/check-paths/allowlist.mts linguist-generated=true
 scripts/check-paths/cli.mts linguist-generated=true
@@ -462,6 +466,7 @@ scripts/check-paths/types.mts linguist-generated=true
 scripts/check-paths/walk.mts linguist-generated=true
 scripts/check-prompt-less-setup.mts linguist-generated=true
 scripts/fix.mts linguist-generated=true
+scripts/install-claude-plugins.mts linguist-generated=true
 scripts/install-git-hooks.mts linguist-generated=true
 scripts/install-sfw.mts linguist-generated=true
 scripts/lint-github-settings.mts linguist-generated=true

CLAUDE.md

@@ -67,6 +67,10 @@ Apply in: worktree creation, base-ref resolution for `git diff`/`git rev-list`,
 - **Backward compatibility** — FORBIDDEN to maintain. Actively remove when encountered.
 - Full ruleset (packageManager field, `.config/` placement, `.mts` runners, soak time, shallow submodules, monorepo `engines.node`) in [`docs/claude.md/fleet/tooling.md`](docs/claude.md/fleet/tooling.md).
 
+### Claude Code plugin pins
+
+🚨 Fleet-blessed Claude Code plugins are SHA-pinned in the wheelhouse-canonical [`.claude-plugin/marketplace.json`](../.claude-plugin/marketplace.json), with companion human-readable metadata (pin date, pinner) in [`.claude-plugin/README.md`](../.claude-plugin/README.md). The pair is enforced together: every `plugins[].source.sha` in `marketplace.json` must have a row in the README table with matching `version` + `sha` + an ISO-8601 `date`. Same staleness signal the GHA `uses:` SHA-pin comments carry. Bump the SHA → bump the row. Run `pnpm run install-claude-plugins` to reconcile a machine to the pinned set; the script also merges `env.CODEX_TRUSTED_ENV_PARENTS` into `~/.claude/settings.json` so the upstream codex plugin honors `~/.claude/session-env/` as a trusted env-file parent (enforced by `.claude/hooks/marketplace-comment-guard/`).
+
 ### Fix it, don't defer
 
 🚨 See a lint/type/test error or broken comment in your reading window — fix it. Stop current task, fix the issue in a sibling commit, resume. Don't label as "pre-existing", "unrelated", or "out of scope" — the labels are rationalizations (enforced by `.claude/hooks/excuse-detector/`).