fix(build): source plugin metadata from repository root

[Katrien De Graeve (katriendg)]

Description

This change moved the HVE Core plugin root from .github to the repository root so plugin clients use the existing root metadata. Root plugin.json became the sole membership authority, while distributable artifact discovery remained bounded to tracked package directories under .github.

Plugin Manifest and Validation

• Relocated the canonical manifest to root plugin.json and changed the marketplace locator to source: ".".
• Emitted repository-relative .github/... paths for agents, commands, rules, skills, and the telemetry hook without changing component membership.
• Separated repository-root containment from .github artifact discovery in plugin synchronization.
• Required root plugin.json, README.md, and LICENSE to be tracked, non-empty regular files, and rejected lexical or resolved paths outside the plugin root.

Consumers and Release Channels

• Updated extension preparation and both installer implementations to consume root-manifest declarations while preserving their existing contribution and target paths.
• Updated release workflows, release-please configurations, and repository version synchronization to use root plugin.json for Stable and PreRelease.
• Rebased telemetry hook commands to resolve collectors from repository-root .github/hooks/... paths.
• Preserved extension-owned extension/README.md and extension/LICENSE as the VSIX metadata surface.

Tests and Documentation

• Expanded focused tests for root metadata, deterministic discovery, path containment, installer parity, extension preparation, workflow packaging contracts, and version synchronization.
• Updated architecture, contributor, customization, installation, package, release, plugin, extension, workflow, and transparency guidance for the repository-root package.
• Updated Copilot CLI examples to select hve-core:rpi-agent while retaining the RPI Agent display name for VS Code guidance.
• Moved label-management guidance from README.md to CONTRIBUTING.md without adding .github/README.md.

Related Issue(s)

Closes #2734

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

AI Artifacts:

• Reviewed contribution with hve-builder and addressed all actionable findings
• Copilot instructions (.github/instructions/*.instructions.md)
• Copilot prompt (.github/prompts/*.prompt.md)
• Copilot agent (.github/agents/*.agent.md)
• Copilot skill (.github/skills/*/SKILL.md)
• Copilot hook (.github/hooks/*/*.json)
• Eval spec added/updated for changed AI artifacts (evals/)

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Sample Prompts (for AI Artifact Contributions)

User Request:

Generate a pull request description for the current branch.

Execution Flow:

The pull-request workflow resolved root plugin.json when assessing distributable membership. Plugin lifecycle events resolved telemetry collectors from repository-root .github/hooks/shared/telemetry/ paths.

Output Artifacts:

The pull-request workflow produced .copilot-tracking/pr/pr-reference-log.md and .copilot-tracking/pr/pr.md. Telemetry hooks continued to emit lifecycle events through the existing shared collector.

Success Indicators:

Plugin validation reported synchronized repository-relative membership, and pull-request generation completed without referring to .github/plugin.json as the membership authority.

For detailed contribution requirements, see:

• Common Standards: docs/contributing/ai-artifacts-common.md - Shared standards for XML blocks, markdown quality, RFC 2119, validation, and testing
• Agents: docs/contributing/custom-agents.md - Agent configurations with tools and behavior patterns
• Prompts: docs/contributing/prompts.md - Workflow-specific guidance with template variables
• Instructions: docs/contributing/instructions.md - Technology-specific standards with glob patterns
• Skills: docs/contributing/skills.md - Task execution utilities with cross-platform scripts

Testing

Validation completed during PR generation:

• npm run validate:docs passed after the documentation remediation.
• npm run spell-check passed with 797 files and no issues.
• npx markdownlint-cli2 docs/customization/packages.md passed for the readiness fix.
• git diff --check origin/main...HEAD passed.

npm run lint:md-links failed on four unchanged external references: three EUR-Lex requests returned HTTP 202 and one Microsoft Learn request returned HTTP 404. npm run validate:local reached the same external-link failures after its preceding checks passed. These failures were classified as non-blocking for this branch and were not remediated outside scope.

Diff-based review found no sensitive values, dependency additions, privilege-expanding security changes, missing referenced files, or non-conventional commits. Manual Agent Plugins, Copilot CLI, release-ref, and installed-footprint checks were not performed.

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

AI Artifact Contributions

• Used hve-builder review mode to review contribution
• Addressed all actionable findings from the hve-builder review
• Verified contribution follows common standards and type-specific requirements

Required Local Checks

The following local-safe validation commands must pass before merging:

• Local validation aggregate: npm run validate:local
• Documentation validation (if docs changed): npm run validate:docs
• Spell checking: npm run spell-check
• Link validation: npm run lint:md-links

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues (N/A: no dependency changes)
• Security-related scripts follow the principle of least privilege (N/A: no security scripts changed)

Additional Notes

• Client-only check done for Agent Plugins metadata rendering in VS Code.

Screenshots before and after:

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

❌ Patch coverage is 98.46154% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 82.95%. Comparing base (818a7ea) to head (e3e7900).

Files with missing lines	Patch %	Lines
scripts/plugins/Sync-PluginManifest.ps1	98.18%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2736      +/-   ##
==========================================
- Coverage   83.22%   82.95%   -0.27%     
==========================================
  Files         180      181       +1     
  Lines       32310    32638     +328     
  Branches       25       25              
==========================================
+ Hits        26889    27075     +186     
- Misses       5418     5560     +142     
  Partials        3        3              

Flag	Coverage Δ
docusaurus	89.92% <ø> (ø)
pester	83.30% <98.46%> (-0.95%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...ller/hve-core-installer/scripts/component-copy.ps1	95.87% <100.00%> (+0.04%)	⬆️
scripts/extension/Prepare-Extension.ps1	88.18% <100.00%> (ø)
scripts/plugins/Sync-PluginManifest.ps1	87.71% <98.18%> (+2.66%)	⬆️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Eval Execution

✅ Status: Passed

• Artifacts evaluated: 0
• Specs run: 0
• Assertions passed: 0
• Assertions failed (blocking): 0
• Assertions failed (advisory): 0
• Failed specs (merge-blocking): 0

No changed AI artifacts required evaluation.