fix(ci): Track canonical plugin drift

Treat generated plugin mirrors and marketplace outputs as managed
canonical artifacts so the main-branch sync bot can stage and commit
them instead of failing on unmanaged drift.

Ignore web-app coverage output during maintainer runs and update the
mirrored Office unpack scripts so plugin copies stay aligned with the
hardened source implementations.

tools/config/generated-files.json

@@ -5,9 +5,13 @@
     "data/skills_index.json",
     "data/catalog.json",
     "data/bundles.json",
+    "data/plugin-compatibility.json",
     "data/aliases.json",
     "apps/web-app/public/sitemap.xml",
-    "apps/web-app/public/skills.json.backup"
+    "apps/web-app/public/skills.json.backup",
+    ".agents/plugins/",
+    ".claude-plugin/",
+    "plugins/"
   ],
   "mixedFiles": [
     "README.md",

tools/lib/workflow-contract.js

@@ -21,6 +21,21 @@ function normalizeRepoPath(filePath) {
   return String(filePath || "").replace(/\\/g, "/").replace(/^\.\//, "");
 }
 
+function matchesContractEntry(filePath, entry) {
+  const normalizedPath = normalizeRepoPath(filePath);
+  const normalizedEntry = normalizeRepoPath(entry);
+
+  if (!normalizedEntry) {
+    return false;
+  }
+
+  if (normalizedEntry.endsWith("/")) {
+    return normalizedPath.startsWith(normalizedEntry);
+  }
+
+  return normalizedPath === normalizedEntry;
+}
+
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -57,11 +72,11 @@ function getManagedFiles(contract, options = {}) {
 }
 
 function isDerivedFile(filePath, contract) {
-  return contract.derivedFiles.includes(normalizeRepoPath(filePath));
+  return contract.derivedFiles.some((entry) => matchesContractEntry(filePath, entry));
 }
 
 function isMixedFile(filePath, contract) {
-  return contract.mixedFiles.includes(normalizeRepoPath(filePath));
+  return contract.mixedFiles.some((entry) => matchesContractEntry(filePath, entry));
 }
 
 function isDocLikeFile(filePath) {
@@ -177,5 +192,6 @@ module.exports = {
   isMixedFile,
   loadWorkflowContract,
   normalizeRepoPath,
+  matchesContractEntry,
   requiresReferencesValidation,
 };

tools/scripts/tests/automation_workflows.test.js

@@ -60,6 +60,10 @@ assert.strictEqual(
 for (const filePath of [
   "apps/web-app/public/sitemap.xml",
   "apps/web-app/public/skills.json.backup",
+  "data/plugin-compatibility.json",
+  ".agents/plugins/",
+  ".claude-plugin/",
+  "plugins/",
 ]) {
   assert.ok(
     generatedFiles.derivedFiles.includes(filePath),
@@ -67,6 +71,13 @@ for (const filePath of [
   );
 }
 
+const webAppGitignore = readText("apps/web-app/.gitignore");
+assert.match(
+  webAppGitignore,
+  /^coverage$/m,
+  "web-app coverage output should be ignored so maintainer sync jobs stay clean",
+);
+
 for (const filePath of [
   "README.md",
   "package.json",

tools/scripts/tests/workflow_contracts.test.js

@@ -16,7 +16,11 @@ const contract = {
     "data/skills_index.json",
     "data/catalog.json",
     "data/bundles.json",
+    "data/plugin-compatibility.json",
     "data/aliases.json",
+    ".agents/plugins/",
+    ".claude-plugin/",
+    "plugins/",
   ],
   mixedFiles: ["README.md"],
   releaseManagedFiles: ["CHANGELOG.md", "package.json", "package-lock.json", "README.md"],
@@ -45,6 +49,20 @@ assert.deepStrictEqual(
   getDirectDerivedChanges(["skills/example/SKILL.md", "data/catalog.json"], contract),
   ["data/catalog.json"],
 );
+assert.deepStrictEqual(
+  getDirectDerivedChanges(
+    [
+      "plugins/antigravity-awesome-skills/skills/docx-official/ooxml/scripts/unpack.py",
+      ".agents/plugins/marketplace.json",
+      "skills/example/SKILL.md",
+    ],
+    contract,
+  ),
+  [
+    "plugins/antigravity-awesome-skills/skills/docx-official/ooxml/scripts/unpack.py",
+    ".agents/plugins/marketplace.json",
+  ],
+);
 
 const changelog = [
   "## [7.7.0] - 2026-03-13 - \"Merge Friction Reduction\"",