site: baked plugin versions drift silently behind the catalog

Publishing sharding v0.0.8 today required running scripts/build-site.js, and the rebuild picked up drift that had nothing to do with that release:

• notation was pinned at v0.6.1 on the live site; the catalog said v0.10.0
• cpanel was pinned at v0.4.0; the catalog said v0.4.4

Both had stale descriptions baked in too.

The cause is the two-layer split. The plugin card grid fetches marketplace.json at runtime, so a ref bump appears there on its own after the raw CDN cache expires. But the version pins, per-plugin JSON-LD (softwareVersion, downloadUrl) and the og:/twitter: meta are SSR'd into the HTML by build-site.js. Those only move when someone runs the generator and commits, and nothing prompts that when a plugin is bumped in the catalog repo.

So the failure mode is quiet and one-directional: the visible card looks current while the structured data search engines read stays months behind, advertising a downloadUrl for a superseded release. Nobody notices, because the part a human looks at is the part that self-heals.

Worth considering, roughly in order of effort:

• A check that fails when the baked regions disagree with the catalog - cheap, and turns a silent drift into a visible one. Could run in the catalog repo's gate or here.
• A repository_dispatch from the catalog repo on a marketplace.json change, so a bump triggers the site rebuild rather than relying on someone remembering.
• At minimum, a line in the publishing runbook saying a catalog ref bump requires a build-site.js run here, since the runtime fetch does not cover it.

Found while publishing sharding v0.0.8 (b135eb3).

Start with scripts/build-site.js and the generated HTML regions for version pins, JSON-LD, and social metadata, then compare them with marketplace.json at the catalog revision from b135eb3. Review the publishing workflow for a suitable check or repository_dispatch trigger. Done means catalog bumps cannot leave baked metadata silently stale, with the mismatch covered by an automated check or rebuild path.