feat(doctor): plugin-cache check + orphan cleanup + post-update reload hint (v3.2.16)

[kengio]

What

Fixes a dual-install split-brain: a stale marketplace plugin cache (~/.claude/plugins/cache/<mkt>/onebrain/<version>) — orphaned by a marketplace install that predated a vault-local update — could shadow the vault-local plugin and make Claude Code load old skills while INSTRUCTIONS.md was current. (Hit live: cache stuck at v2.2.4 while vault-local was v3.1.3.)

Changes

• doctor plugin-cache check (Vault structure section) — reports stale cached plugin versions (cache vs the vault-local pin). --fix prunes them, then re-detects to report an honest result: Failed (non-zero exit), not a misleading Fixed, if a removal hits a permission error.
• cache_clean — read-only detect_stale_plugin_cache sibling to clean_plugin_cache, sharing one enumeration pass (version_dirs_under); skips symlinks (symlink_metadata, no follow) and rejects path-traversal marketplace keys (onebrain@../...).
• plugin update — post-update ↻ /reload-plugins next-step whenever a real version change lands; fires on partial-failure-with-version-change too (the version already landed on disk).
• Consolidated installed_plugins.json path resolution into one shared default_installed_plugins_path.

Verification

• cargo fmt + cargo clippy --workspace --all-targets clean (0 warnings)
• cargo test --workspace — 1294 passed / 0 failed (+8 new tests)
• live smoke on the real vault: doctor ok-path + warn-path (fake orphan); onebrain --version → 3.2.16
• 3-round parallel review — R1 (correctness/convention · silent-failure/safety · type/design) found 1 High + 2 Medium (reload hint suppressed on partial failure · marketplace path traversal · false-success on permission error) → fixed; R2 (×2) verified all resolved + approved; R3 holistic sign-off → GO

Version: patch 3.2.15 → 3.2.16 (a doctor sub-check + --fix recipe + an output line — no new first-level command). CHANGELOG updated.

🤖 Generated with Claude Code