Fix silent host-loading failures found by real install

[sasdeployer]

claude plugin details on an installed build reported MCP servers (0) and Hooks (0) while validate.py, claude plugin validate --strict, and a Cursor-side review all passed. Static schema checks cannot see this. Cause isolated with two-arm experiments on throwaway plugins.

Host loading:

• Claude Code discovers MCP only from a dot-prefixed .mcp.json at the plugin root. "mcpServers": "./mcp.json" and an inline object are both ignored. Ship .mcp.json alongside mcp.json, which Agent Plugins 1.0 and Cursor still require.
• A Claude Code hook command must be one shell string; a list is dropped without error. hooks/claude-code.json now uses a string.
• hooks/cursor.json -> hooks/hooks.json with "version": 1. Scanners look for the default filename; cursor.directory's auto-detect found 7 components and no hook under the old name.

After: Skills 2, Agents 1, Hooks 1, MCP servers 1 on a real install.

Validator (the gate that missed all of the above):

• check_mcp_discovery: .mcp.json must exist and match mcp.json
• check_hook_schemas: no list commands, Cursor file carries version: 1
• both confirmed to fire by deliberately breaking each

Listing copy:

• 55 tools, not 59. Four billing tools are registered server-side but runtime-gated, so a connected client never sees them.
• patches/0003 scrubs the internal tool name that survived 0002 in SKILL.md frontmatter and both antipattern references, and replaces named third-party platforms in SKILL.md's decision tree and reference table. SKILL.md is inlined verbatim into marketplace listings, so its text is public copy.

Docs:

• CHANGELOG: Unreleased sat below 1.0.0 while holding work already in the tree. Folded in.
• PLATFORMS.md: recorded both loading rules; removed a paragraph claiming Devin has no plugin format that contradicted the matrix two lines above.

Out of scope:

• references/MIGRATION.md keeps competitor names on purpose — a migration guide has to name what you migrate from, and references are not inlined.
• Cursor is still unverified by a live editor install.
• sync-from-mcp.sh --check not run; claudecode-mcp-go is not cloned here.