Coordinate external marketplace sources before merging the plugins/slack/ refactor (#86)

**Blocks merging #86

The plugins/slack/ refactor moves plugin.json, skills/, commands/, and the MCP configs from root into plugins/slack/. Our plugin is distributed through two external, SHA-pinned marketplace that resolves to the repo root, so we need to coordinate with https://github.com/anthropics/claude-plugins-official

1. Claude Code (https://github.com/anthropics/claude-plugins-official): must fix before/with the merge

Their entry for slack uses source: "url", which resolves at the repo root with no subpath support:

{ "source": { "source": "url", "url": "https://github.com/slackapi/slack-mcp-plugin.git", "sha": "<pin>" } }

After the refactor there is no root plugin.json / skills/, so a url source clones the root and resolves the plugin empty.

[!WARNING]
The SHA pin is bumped automatically. A bump/slack bot opens SHA-bump PRs multiple times per day. There is no manual gate on our side. The next automated bump after this refactor lands on main will advance the pin onto the refactored commit and break the listing. (The bot runs claude plugin validate before opening a bump PR, but that's a partial safety net, not something to rely on.)

Fix: open a PR to https://github.com/anthropics/claude-plugins-official switching the slack entry from url to git-subdir with "path": "plugins/slack" (the pattern their own airtable entry already uses):

{
  "source": {
    "source": "git-subdir",
    "url": "https://github.com/slackapi/slack-mcp-plugin.git",
    "path": "plugins/slack",
    "ref": "main"
  }
}

Sequencing (critical): that external PR must land before or at the same time as the refactor merges to our main. If the refactor lands first, the next auto-bump breaks the listing before the source-type fix is in.

2. Cursor Marketplace (cursor.com/marketplace/slack)

• Current listing is pinned to an old frozen SHA (b647da9) and only reads the MCP url + CLIENT_ID from the then-root mcp.json; no auto-bumper found → the refactor does not break the current listing.
• README install is a self-contained base64 MCP deeplink, independent of repo layout → fine.
• But: a future re-pin or "Import from Repo" expects root mcp.json / .cursor-plugin/plugin.json, which no longer exist at root, and Cursor's subdirectory support is undocumented. Confirm with Cursor whether the listing needs updating for the subdir layout, or leave the frozen pin as-is.

Ordered checklist

• Draft the claude-plugins-official PR switching slack to git-subdir + path: plugins/slack (mirror airtable).
• Confirm with Anthropic / the bump-bot owners how the automated bump interacts with a source-type change (does the bot preserve source: git-subdir, or does it need a one-time manual merge?).
• Land the external PR before or with merging #86 to main.
• Merge #86; watch the next auto-bump PR in https://github.com/anthropics/claude-plugins-official and verify a fresh /plugin install slack@claude-plugins-official resolves non-empty.
• Verify the Cursor Marketplace listing for the subdir layout (or confirm the frozen pin is unaffected).

Related follow-up (out of scope)

Repo rename slack-mcp-plugin → slack-skills (tracked in #86's description). Orthogonal to this source-type fix and carries its own coordination risk; handle separately.

Open question to resolve first

The single biggest unknown is how the automated bump/slack bot handles a source object that is no longer url, whether it rewrites the whole source shape on each bump or only touches sha. This determines whether the git-subdir switch is a one-time change or needs bot-side support. Worth confirming with the bump-bot owners before drafting the external PR.

Start by confirming with the bump-bot owners how the automated bump/slack process handles changing the source object from url to git-subdir, then inspect the slack entry and the existing airtable pattern in claude-plugins-official. Draft and land the external source-type change before or with #86, then verify the next bump resolves the plugin non-empty and confirm the Cursor listing remains valid.