refactor: prepare Claude marketplace plugin handoff

[ducnmm]

Summary

Prepare the public repository as the Claude Code marketplace plugin handoff requested by Kimberly.

• keep MystenLabs/MemWal/packages/mcp as the only canonical SDK/npm source
• move the Claude plugin package to the repository root
• consume @mysten-incubation/memwal-mcp through .mcp.json
• remove duplicated SDK source, package metadata, and SDK integration tests
• retain marketplace manifest, setup skill, slash commands, hooks, and usage docs
• update hosted connector documentation after feat(mcp): OAuth 2.1 foundation + authorization server for Claude custom connectors (1-2/3) MystenLabs/MemWal#584 merged and passed dev smoke testing
• validate JSON, hook syntax/signals, package layout, and Claude's strict plugin validator in CI

Validation

• npx -y @anthropic-ai/claude-code plugin validate . --strict
• node --test test/*.test.mjs (6/6)
• all JSON manifests parse
• all hook scripts pass node --check
• git diff --check

Handoff boundary

This repository does not publish an npm package. SDK source, versioning, tests, and npm publishing remain in MystenLabs/MemWal/packages/mcp. The repository is temporarily under CommandOSSLabs and intended for transfer to MystenLabs before official marketplace submission.

[ducnmm]

@harrymove-ctrl Please accept the repository invitation, then review exact current HEAD caed0dff5e9b336f9977a6d1ab056155cb47daf8. This separates the marketplace plugin from the canonical MCP SDK/npm source; CI and strict Claude validation are green.

[ducnmm]

Reviewed exact head caed0dff5e9b336f9977a6d1ab056155cb47daf8. The root marketplace layout is valid, strict Claude validation passes, hook tests pass, the duplicate SDK/npm source is removed, and branch protection/reviewer setup is correct.

One release-order blocker remains:

[P1] The plugin currently promises hot credential reload, but the package it actually installs does not contain that fix yet. .mcp.json runs unpinned npx -y @mysten-incubation/memwal-mcp, which currently resolves to npm latest = 0.0.6. The live-credential fix from MemWal #597 merged after the 0.0.6 release; PR #604 only adds the missing changeset and has not released a new npm version. However, skills/setup/SKILL.md:53 and skills/setup/SETUP.md:74 tell users that current MCP releases reload credentials without restart. A user installing this plugin today receives 0.0.6 and can hit exactly the stale post-login behavior those instructions say is fixed.

Please make the rollout dependency explicit and enforce it before marketplace merge/submission: merge #604, publish the patched MCP package (expected 0.0.7 or later), verify npm view @mysten-incubation/memwal-mcp version, then rerun a clean-install login smoke using this plugin. Alternatively, keep the current troubleshooting wording until that release exists. Adding a CI/assertion for the minimum package version would prevent publishing the plugin against an older npm latest.

The remote connector decision is correct: dev is validated, while staging/prod discovery returning 404 means promotion must remain gated on staging then production OAuth smoke tests.

I cannot submit a formal changes-requested review because this PR is authored by the current GitHub account; treating this comment as the blocker for Harry's exact-head review.

[ducnmm]

Addressed the rollout blocker in new HEAD 4029870: reverted troubleshooting docs to require restart until release verification, and added scripts/check_mcp_release.mjs plus a CI rollout gate requiring stable npm latest >= 0.0.7. The gate currently fails intentionally because npm latest is still 0.0.6. After MemWal #604 merges and publishes 0.0.7+, CI will unblock; we will then run the clean-install plugin login smoke before requesting final exact-head approval/merge. @harrymove-ctrl please review only after that release smoke is posted.

[ducnmm]

Re-reviewed new exact head 40298706c2c18987d86f9b371a1c90d6dc4b1c24. My rollout finding is addressed correctly:

• troubleshooting no longer claims the currently published package supports hot credential reload;
• scripts/check_mcp_release.mjs queries npm latest and requires a stable version >=0.0.7;
• the protected required validate check runs that gate;
• the current CI failure is intentional and accurate because npm latest is still 0.0.6;
• strict Claude validation and all 6 hook tests still pass locally; git diff --check is clean.

No code changes requested. Keep this PR blocked until #604 is merged, the patched MCP package is published, npm latest reports 0.0.7+, this required check turns green, and a clean-install browser-login smoke confirms the package actually reloads credentials. Harry should approve this new exact head only after those conditions hold.

The staging → production OAuth promotion/smoke gate remains separate and unchanged.

[harrymove-ctrl]

Approved branding update and marketplace package setup.