ci: guard against package.json / plugin.json version skew

[walkindude]

Summary

The plugin manifest at `.claude-plugin/plugin.json` was silently out of sync with `package.json` between v0.1.0 and v0.1.2 (0.1.0 on the plugin side vs 0.1.1 on package). The README's release instructions ("bump the `version` field in `.claude-plugin/plugin.json` and `package.json`") rely on the releaser remembering both files. The skew was caught by eyeballing during the v0.1.2 release, which is the worst possible mechanism.

This PR replaces eyeballing with a deterministic check at two layers:

• `scripts/check-versions.mjs`: reads both files, asserts the `version` fields match, exits 1 with a human-readable mismatch report when they don't.
• `package.json`: adds `pnpm run check:versions`.
• `lefthook.yml`: pre-commit hook on a glob of `{package.json,.claude-plugin/plugin.json}` blocks the commit on mismatch.
• `.github/workflows/ci.yml`: `pnpm run check:versions` runs in the `check` job so the gate holds on PRs even when local hooks are bypassed (`--no-verify`) or simply not installed by a contributor.

Test plan

• `node scripts/check-versions.mjs` against the current matched 0.1.2 / 0.1.2 state → `check-versions: ok (0.1.2)`
• Manually nudged `.claude-plugin/plugin.json` to 0.1.99, re-ran the script → exits 1 with the mismatch report and the rationale ("released as a single artifact")
• Lefthook pre-commit on this branch ran the new hook successfully (visible in the commit log)
• CI on this branch will exercise the new `check:versions` step

🤖 Generated with Claude Code