Add CI to validate manifests, skill frontmatter, and install.sh

[prorochestvo]

Context

This repo is the source of truth for every consuming project. A malformed
marketplace.json, plugin.json, permission fragment, or SKILL.md frontmatter breaks
plugin resolution in every downstream project, and today nothing catches it before
push (single squashed history, no CI, no validation target).

Proposal

A GitHub Actions workflow plus a locally runnable script (scripts/validate.sh) that on
PR/push validates:

• Every JSON file parses: marketplace.json, all plugins/*/.claude-plugin/plugin.json,
  all plugins/pipeline/skills/sync-permissions/*.json.
• marketplace.json plugin source paths point to existing directories, and each
  referenced plugin has a .claude-plugin/plugin.json.
• Every SKILL.md and every agent *.md has valid YAML frontmatter with the required
  keys (name, description; paths optional), and name matches its directory.
• Permission fragments contain only allow / deny arrays of strings.
• Smoke test: run install.sh go <tmp> and install.sh flutter <tmp>; assert
  CLAUDE.md + .claude/settings.json are produced and the settings JSON parses.
• Guard the python3 dependency install.sh relies on for the settings merge — the
  script should fail with a clear message if python3 is absent, and CI should cover it.

Acceptance criteria

• .github/workflows/validate.yml is green on a clean tree.
• It fails on an intentionally broken manifest / frontmatter (prove it in the PR).
• scripts/validate.sh runs the same checks locally.
• The install.sh smoke test is part of the workflow.