feat: use git clone with submodule support and add manifest tests

- Replace tarball download with git clone --recurse-submodules (fallback to tarball)
- Add 25 test cases for plugin manifest, marketplace, scanner, and MCP transform
- Cover: custom paths, pluginRoot, flat source layout, env var transform, pluginFiles

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 2 people

.claude/settings.local.json

@@ -0,0 +1,17 @@
+{
+  "permissions": {
+    "allow": [
+      "WebFetch(domain:developers.openai.com)",
+      "WebFetch(domain:cursor.com)",
+      "Bash(xargs ls:*)",
+      "WebFetch(domain:opencode.ai)",
+      "WebSearch",
+      "WebFetch(domain:gist.github.com)",
+      "WebFetch(domain:deepwiki.com)",
+      "WebFetch(domain:github.com)",
+      "Bash(npx tsc:*)",
+      "Bash(npx vitest:*)",
+      "Bash(git clone:*)"
+    ]
+  }
+}