ci: auto-update external-plugin pins via scheduled workflow

[antonbabenko]

What

Generic, repo-local automation to bump external-plugin pins (today: terraform-skill; future plugins auto-discovered) instead of the manual two-manifest edits we did in #4/#5.

Design (/ask-both: GPT + Gemini both -> Option A)

• .github/scripts/update_external_plugins.py (stdlib-only): discovers external entries (source.source == github) from .claude-plugin/marketplace.json, cross-checks the name-matching .agents/plugins entry, resolves the latest eligible upstream release (semver, no prereleases by default; github-tags mode optional), and atomically rewrites source.ref in both manifests + the mirrored .claude-plugin version. --dry-run; fails hard on upstream rename / deleted tag / API error; "nothing to do" exits 0.
• .github/workflows/update-external-plugins.yml: daily cron + workflow_dispatch; opens a reviewable chore(external-plugins): ... PR via peter-evans/create-pull-request SHA-pinned (v8.1.1); contents+pull-requests: write only; no pull_request_target.
• .github/external-plugin-updates.json: policy overlay (defaults + per-plugin overrides). JSON (not YAML) to keep the updater dependency-free - documented deviation from the plan.
• validate.yml: .agents/plugins/** added to trigger paths + a new cross-manifest sync check (repo/ref parity, version == v+ref).
• Docs updated; pins are no longer hand-bumped.

Safety

• Manifest/CI-only, ci: type -> no agent-plugins release (verified against the path+type detection).
• Human review by default (no auto-merge; repo has no server-side required checks).
• Two-manifest drift guarded by the new CI check; updater always writes both.

Verified

• Workflows YAML + policy JSON valid; script compiles.
• Live dry-run against GitHub: correctly detects the real pending terraform-skill v1.10.0 -> v1.11.0, exit 0, no writes.
• Cross-manifest sync check PASSes on the current synced tree.

After merge: the scheduled run (or a manual workflow_dispatch) will open the first real bump PR (terraform-skill -> v1.11.0).