fix: sync package-lock.json to the plugin version and gate the drift (#16)

[Weegy]

Fixes #16.

The bug

package-lock.json recorded packages/plugin at 0.3.1 while its package.json moved on to 0.3.4 across #8, #13 and #15. Nothing caught it — and nothing could: npm ci reconstructs the dependency tree, and a workspace member's own version field is not part of that tree. A drifted lockfile installs cleanly, tests green, packages a correct ZIP, and quietly tells every reader of a public repository that this plugin is a version it has not been for three releases.

Why this isn't just npm install --package-lock-only

That command repairs the member entry and, in the same pass, rewrites

"../odoo-bot/middleware/packages/plugin-api"

from whatever core checkout happens to sit next to this repo on the machine it runs on — committed as 0.1.0, but 1.10.0 on the machine that shipped this fix. npm has no way to know that file: target is a working tree rather than a pinned dep, so the only safe tool is one that cannot write at all.

What this PR does

#	Change	Where
1	Surgically bump only the packages/plugin lockfile entry 0.3.1 → 0.3.4 (one line). The external stays exactly as committed; no other member had drifted.	package-lock.json
2	Read-only checker: asserts, for every workspace member (root included), lockfile version == package.json version. Prints the exact by-hand fix and forbids the regeneration that leaks the local core checkout. Refuses any workspaces pattern it cannot safely expand — outside-repo, a missing named member, or an unsupported glob — rather than silently checking fewer members than the workspace has.	scripts/check-lock-sync.mjs
3	Wire the gate into npm run package and into CI before npm ci (where npm ci genuinely cannot see the drift). Add npm run check:lock.	build-zip.mjs, ci.yml, package.json
4	Tests: discovery, drift, the external-is-never-a-member invariant, dot-dir / outside-repo / missing-literal guards, the error message, and that both wiring points are actually in place.	packages/plugin/test/lockSync.test.ts
5	Document the three-file version contract and the hand-edit rule.	CONTRIBUTING.md

Version stays 0.3.4 — lockfile and tooling only. No release, no hub publish.

Verification

Run locally against pgvector/pgvector:pg16 and core main:

• npm run check:lock → ✓ 6 workspace entries checked
• npm ci from a clean tree → exit 0
• npm run typecheck && npm run build → clean
• npm test → 1371 pass, 0 fail, 0 skipped (827 + 76 + 468)
• npm run package → omadia-dev-platform-0.3.4.zip, payload verified, ZIP package.json reads @omadia/dev-platform 0.3.4

Mutation-checked that the gates bite: reintroducing the drift fails the CLI, the packaging gate and the suite; removing the build-zip.mjs call or reordering the CI step each fails a dedicated wiring test.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}