feat: add cef plugin (cef:develop + cef:deploy)

[upalinski]

Adds the cef Claude Code plugin — the centrally-published, auto-updated authoring guidance that cef init-scaffolded projects auto-wire (via .claude/settings.json).

Contents

• .claude-plugin/marketplace.json — marketplace cef; plugins/cef/.claude-plugin/plugin.json — plugin cef v0.1.0.
• cef:develop (model-invoked) — author/extend/debug agents. Lean SKILL.md routing into references/: anatomy, engagements, cubbies, widgets, testing, constraints.
• cef:deploy (confirmation-gated) — the build → push → deploy workflow (deploy makes an agent live; publish is optional/last), the deployments/ folder, and a "detect the missing prerequisite → hand back the exact next step" table. references/: credentials, roc-deploy.

Design

Two skills, from the developer-journey UX analysis: steps that share the "developing a CEF agent" trigger → one develop skill; shipping is a distinct, side-effecting intent → separate deploy skill.

Public-safe

No internal decision-record IDs, private source paths (packages/.../src, .go), orchestrator/TSS-DKG/vault-api naming, or example emails. claude plugin validate ✔; validate + CodeQL green.

Review fixes applied (spoluyan + owner)

• agentId is {asPubkey}:{alias} everywhere (was stale {uuid}).
• cef publish = agent card on the marketplace (optional, last); the manifest stays in the DDC bucket; dropped "stub"; pipeline reordered so deploy precedes publish.
• multi-engagement selection example uses per-engagement priority/weight/limit (+ @Priority/… decorators), not the deprecated targeting table; disambiguated agent-config targeting (deprecated) vs deployment targeting (current, verified against the orchestrator structs).
• dropped the unsupported lifecycle config setting from the cubbies example (the @OnStart/@OnClose methods stay).
• cef deploy documented as shipped; --deployments <path> accepts a file or a directory (kubectl-apply -f style).

Authored via a parallel workflow (references + skills), then reviewed and revised.

🤖 Generated with Claude Code

[spoluyan]

CI is green (validate / CodeQL / Analyze) and the structure is solid: the two-skill split (shared develop trigger vs. side-effecting deploy intent) is the right call, the "detect the missing prerequisite → hand back the exact next step" table is genuinely useful, and the two-identity model (DDC bucket owner vs. Agent Service) is clearly explained. ADR/source-path scrubbing in commit 4 is good hygiene for a public plugin.

Requesting changes for content contradictions that claude plugin validate can't catch but a user following the deploy flow will hit:

1. 🔴 cef deploy is "coming" in roc-deploy.md but shipped in deploy/SKILL.md — and the SKILL.md links to that file. Reconcile roc-deploy.md to the shipped-CLI reality (commit 8b04053 updated SKILL.md but not its reference).
2. 🟠 agentId shape disagrees — {pubkey}:{uuid} (anatomy) vs {pubkey}:{alias} (credentials, roc-deploy). Users construct deployment keys from this.
3. 🟠 targeting is DEPRECATED in anatomy but the only mechanism shown in engagements.md — the file pitched as teaching "selection decorators" demonstrates the deprecated path and never shows @Condition/@Priority/@Weight/etc.
4. 🟡 "stub pending the API" for publish contradicts the deploy skill treating publish as fully functional.
5. 🟡 Minor: lifecycle: "per-stream" in the cubbies example isn't in anatomy's field list.

Inline comments below cite exact locations. Issues 1–2 are in the deploy path and will actively mislead a user mid-flow; 3–5 are adjacent and worth fixing in the same pass.