feat(distribution): adopt agent-plugins as a sync target

[kyle-sexton]

Closes #439

Summary

Adopt melodic-software/agent-plugins as the twelfth sync target. The repo was created 2026-08-17 — after the standards-sync-audit plan's Phase 4 roster locked — so its absence there is chronology, not a considered exclusion; the operator granted it to the melodic-standards-sync installation on 2026-08-19 and directed adoption.

Fix

Adds the melodic-software/agent-plugins target block (hygiene set: editorconfig-checker, gitleaks, lychee, markdownlint, repository-text, typos — plus cloud-bootstrap; automerge: false), its public fail-closed TARGET_VISIBILITY entry, and moves the spawn-shim arity assertion 11 → 12. The repo carries none of the payloads yet, so the first sync CREATES them — adoption from birth, no divergence to reconcile. With the operator's pending removal of knowledge-corpus and songwriting from the grant, attest equality lands at 12.

Verification

• bash distribution/sync-manifest.sh validate (staged) → Manifest valid: 33 components, 12 targets
• gh repo view melodic-software/agent-plugins --json visibility → PUBLIC (matches the new TARGET_VISIBILITY entry)
• Diff scoped to 3 files / 18 insertions; no component definitions touched

Related

• feat(distribution): Phase 4 fleet expansion — three new sync targets #428 (Phase 4 roster this extends)
• melodic-software/github-iac#337 (roster mirror — follow-up bumps it to 12)

🤖 Generated with Claude Code

[claude]

Claude finished @kyle-sexton's task in 2m 22s —— View job

---

Claude's Review Progress

• Gather context (PR body, changed files, custom instructions)
• Run code-review procedure (manual, /review:code-review skill invocation failed to execute in this environment — see note below)
• Post findings

Summary

This is a clean, mechanically-consistent change. I verified:

• distribution/sync-manifest.yml: the new melodic-software/agent-plugins target block (L302-311) has the identical managed shape (alphabetically ordered) and automerge: false as its stated sibling marketplace targets codex-plugins and cursor-plugins, confirmed by diffing those blocks directly.
• components/runner-policy/runner-policy.test.mjs: the TARGET_VISIBILITY entry (L8884) is placed correctly in the alphabetical public block. It isn't actually exercised by isPublicTarget yet (that helper is only invoked for targets managing a components/claude-lanes/* component, which agent-plugins doesn't manage), but the entry is added proactively for completeness — same posture as the pre-existing codex-plugins/cursor-plugins entries, so this is consistent, not dead weight.
• distribution/sync-manifest.test.sh: the 11 targets → 12 targets assertion (L499) is a straightforward reflection of .targets | keys | length in sync-manifest.sh (confirmed by reading the script's validate handler) — the count bump is mechanically correct for a single new top-level targets key, and component count (33) is untouched since no new component was introduced.
• I did not find any other hardcoded target-count or target-name enumeration elsewhere in the repo (docs, other test files) that would need updating alongside this change — docs/topics/standards-sync-audit/PLAN.md's historical 11 targets mentions are point-in-time merge records, not live counts, so leaving them as-is is correct.
• No functional, security, or correctness issues found. No inline comments filed — nothing anchors to a specific defect on a changed line.

Note: the /review:code-review skill invocation returned an error (Execute skill: review:code-review) each of the three times I tried it in this environment, so I performed the equivalent review manually (diff read, cross-reference against sibling targets, and static verification of the count logic) rather than following the skill's exact internal steps. Worth checking the skill/plugin wiring for this lane if that's unexpected.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.