fix(issue-body-contract): deliver the plugin contract to one root path

components/issue-body-contract/README.md

@@ -9,8 +9,7 @@ slice `/work-items:decompose` publishes. Everything that writes or checks an iss
 | Consumer | How it gets the contract |
 | --- | --- |
 | Org issue forms in `melodic-software/.github` `.github/ISSUE_TEMPLATE/` | [`issue-forms.mjs`](issue-forms.mjs) generates [`forms/`](forms/) from the contract; the sync (`issue-forms` component) materializes them byte-exact, with the contract beside them at `.github/standards/issue-body-contract/contract.json` for that repository's own drift check |
-| `/bugs:write` | sync copy at `plugins/bugs/reference/issue-body-contract.json` in `claude-code-plugins` |
-| `/work-items:track add`, `decompose`, `triage` | sync copy at `plugins/work-items/reference/issue-body-contract.json` in `claude-code-plugins` |
+| `/bugs:write`; `/work-items:track add`, `decompose`, `triage` | sync copy at `docs/contracts/issue-body/contract.json` in `claude-code-plugins`, which that repository's `scripts/sync-shared-copies.sh` copies into each plugin's `reference/issue-body-contract.json` |
 
 `config.yml` (blank issues off, the `SUPPORT.md` contact link) stays owned by
 `melodic-software/.github`; the sync never touches it.

components/managed-files-guard/managed-files-guard.yml

@@ -74,6 +74,7 @@ on:
       - .shellcheckrc
       - REVIEW.md
       - _typos.toml
+      - docs/contracts/issue-body/contract.json
       - docs/conventions/source-control/commit-convention.yml
       - docs/standards/README.md
       - docs/standards/bulk-mutation.md
@@ -88,9 +89,7 @@ on:
       - eng/dotnet-analysis/Directory.Build.props
       - eng/dotnet-analysis/dotnet.globalconfig
       - lychee.toml
-      - plugins/bugs/reference/issue-body-contract.json
       - plugins/guardrails/lib/path-detection/machine-path-patterns.sh
-      - plugins/work-items/reference/issue-body-contract.json
 
 permissions:
   contents: read

distribution/sync-manifest.yml

@@ -228,13 +228,12 @@ components:
   # forms are generated from contract.json at authoring time and land byte-exact
   # in the org-defaults repository with the contract beside them for its local
   # drift check. config.yml stays repo-owned there. The two plugin copies are
-  # the skeletons bugs:write and the work-items skills read.
-  issue-body-contract-bugs:
+  # the canonical claude-code-plugins fans out with its sync-shared-copies.sh into
+  # the plugins that read it (bugs:write, the work-items skills), since a byte-
+  # identical file in two plugins must be registered in the same change.
+  issue-body-contract-plugins:
     files:
-      components/issue-body-contract/contract.json: plugins/bugs/reference/issue-body-contract.json
-  issue-body-contract-work-items:
-    files:
-      components/issue-body-contract/contract.json: plugins/work-items/reference/issue-body-contract.json
+      components/issue-body-contract/contract.json: docs/contracts/issue-body/contract.json
   issue-forms:
     files:
       components/issue-body-contract/contract.json: .github/standards/issue-body-contract/contract.json
@@ -614,8 +613,7 @@ targets:
       - engineering-standards
       - github-actions-conventions
       - gitleaks
-      - issue-body-contract-bugs
-      - issue-body-contract-work-items
+      - issue-body-contract-plugins
       - lychee
       - lychee-online-claude-code-plugins
       - managed-files-guard-caller