fix(devcontainer): harden marketplace registration error handling

Address code review findings in register-plugin-marketplaces.sh:
surface jq parse errors instead of silently swallowing them,
capture CLI output to prevent noisy terminal interleaving,
add 30s timeout to prevent hung registrations, and switch
from pipe-to-while to here-string pattern. Add ordering
dependency comment to post-create.sh.

Author: johnzook

image/scripts/post-create.sh

@@ -104,6 +104,8 @@ pnpm install -g "@google/gemini-cli@${GEMINI_CLI_VERSION}"
 echo "✓ CLI tools installed"
 
 # Step 6: Register plugin marketplaces from project settings
+# NOTE: Must run BEFORE firewall init (step 10) — marketplace registration
+# clones git repos and needs unrestricted network access.
 echo ""
 echo "[6/12] Registering plugin marketplaces..."
 /usr/local/bin/register-plugin-marketplaces.sh "$WORKSPACE_ROOT"

image/scripts/register-plugin-marketplaces.sh

@@ -24,23 +24,28 @@ if [ ! -f "$PROJECT_SETTINGS" ]; then
 fi
 
 # Extract git URLs from extraKnownMarketplaces
-URLS=$(jq -r '
+if ! URLS=$(jq -r '
   .extraKnownMarketplaces // {} |
   to_entries[] |
   select(.value.source.source == "git") |
   .value.source.url
-' "$PROJECT_SETTINGS" 2>/dev/null)
+' "$PROJECT_SETTINGS" 2>&1); then
+  echo "  ⚠ Failed to parse $PROJECT_SETTINGS: $URLS"
+  exit 0
+fi
 
 if [ -z "$URLS" ]; then
   echo "  No extraKnownMarketplaces defined in project settings"
   exit 0
 fi
 
-echo "$URLS" | while read -r url; do
+# Registration is idempotent-safe: failures (including duplicates) are logged but non-fatal
+while IFS= read -r url; do
   echo "  Registering marketplace: $url"
-  if claude plugin marketplace add "$url" 2>&1; then
+  if output=$(timeout 30 claude plugin marketplace add "$url" 2>&1); then
     echo "  ✓ Registered: $url"
   else
     echo "  ⚠ Failed to register: $url"
+    echo "    $output"
   fi
-done
+done <<< "$URLS"