ci: gate PRs on a version bump when commands change

[nadaverell]

Why

Plugins set an explicit version, so Claude Code only delivers updates to installed users when it's bumped. A command change can otherwise merge to main and never reach anyone — which just happened: the /pr edit (#4) shipped no bump and went unreleased until a follow-up.

What it does

A pull_request check that:

• fails the PR if anything under plugins/skyhook-skills/commands/ changed but plugin.json version wasn't bumped vs the base branch, and
• verifies the three version fields agree (marketplace.json metadata.version, marketplace.json plugins[].version, plugin.json version).

Chosen over auto-bump-on-merge deliberately: the maintainer keeps the semver decision, it needs no write access to main, and non-shipping edits (README, etc.) aren't forced to bump.

---

Note

Low Risk
CI-only addition with no runtime, auth, or shipped command behavior changes.

Overview
Adds a pull_request → main workflow that blocks merges when shipped plugin commands change without a release bump, and when version metadata drifts across files.

On every PR it compares plugins/skyhook-skills/commands/ to the base branch; if anything changed, plugins/skyhook-skills/.claude-plugin/plugin.json version must differ from base or the job fails with a clear error. It always checks that plugin.json version, .claude-plugin/marketplace.json metadata.version, and marketplace.json plugins[0].version match.

Checkout uses fetch-depth: 0 so git show / three-dot diffs against origin/${BASE_REF} work. No auto-bump — maintainers choose semver; README-only PRs aren’t forced to bump.

^{Reviewed by Cursor Bugbot for commit 9709667. Bugbot is set up for automated code reviews on this repo. Configure here.}

[nadaverell]

Switching to auto-bump-on-merge (main is unprotected, so the bot can bump directly) — superseded by the auto-version-bump workflow. The check approach still made you do the bump manually; auto-bump removes the step.