Add daily marketplace version auto-sync

[AnthonyLedesma]

Drives the source-of-truth versions in .claude-plugin/marketplace.json off each plugins latest GitHub release tag instead of hand-bumping.

What

• scripts/sync_marketplace_versions.py: stdlib-only Python (no third-party HTTP client). Derives owner/repo from each entry source.url or homepage, fetches /releases/latest from the GitHub API, normalizes the leading v on tags, writes back if different. Exits 0 on no-drift, 1 on drift (so the workflow can branch on it), 2 on transport/schema error.
• .github/workflows/sync-marketplace-versions.yml: daily cron at 09:17 UTC, plus workflow_dispatch (with --dry-run input), plus pull_request trigger that runs the script in dry-run on PRs touching either file (so the script is exercised in CI before merge).

Why

• guard just shipped 1.4.1 but the marketplace says 1.0.0; convo similarly. The display fields aren’t a functional gate (Claude Code installs by source URL), but they’re publicly visible portfolio surface and drift reads as careless.
• Auto-sync removes the manual-bump-per-release step entirely. First merged run will produce a PR bumping guard to 1.4.1 and convo to 1.1.0.

Notes

• PR-based, not direct-to-main: a botched GitHub API response writing a garbage tag should be reviewable before landing.
• Action SHAs pinned, scoped permissions per-job (sync job is contents:write + pull-requests:write only).