[FEAT] Layer 2: package the CLI as a Claude Code plugin (marketplace + plugin.json + skills) #3

Part of #2 — this issue tracks layer 2: packaging the already-merged CLI (pnpm analyze:session / pnpm analyze:sessions) as an installable Claude Code plugin with a skill, so the audit is consumable by Claude Code itself (/plugin marketplace add axisrow/claude-devtools → /plugin install).

Scope — files to add

1. .claude-plugin/marketplace.json (repo root → repo becomes a marketplace):
   • name, owner, plugins: [{ name: "session-audit", source: "./" }]
2. .claude-plugin/plugin.json (plugin root = repo root):
   • name: "session-audit", description (core fields only; version omitted → git-SHA pinning, users get updates on push — decide at review whether to pin instead)
3. skills/audit-session/SKILL.md — auto-invocable + /audit-session:
   • frontmatter: description (drives model invocation), when_to_use, allowed-tools: Bash(pnpm analyze:session:*)
   • body: how to pick the session file (--project <dir> --last), how to read the ledger (context growth, reread share), each finding type (duplicate_call / failed_call / oversized_output / context_spike / cache_dead / thinking_heavy / slow subagents) and what to recommend (deny rules for culprit commands, splitting long turns, slimming parent context via subagents)
4. skills/sessions-inventory/SKILL.md — /sessions-inventory:
   • frontmatter with allowed-tools: Bash(pnpm analyze:sessions:*); body: filters (--min-minutes, --sort, --limit) and how to present the table + billing scheme column
5. CI (optional): a workflow step running claude plugin validate .

Per current plugin docs, commands are legacy — skills with user-invocable/description serve both slash- and model-invocation, so no commands/ directory. Components live at plugin root, NOT inside .claude-plugin/.

Acceptance criteria

• claude plugin validate . passes
• claude --plugin-dir . in a scratch session: /audit-session runs the CLI on the active session and summarizes findings; /sessions-inventory renders the table
• End-to-end: /plugin marketplace add axisrow/claude-devtools + /plugin install session-audit@… works from a clean clone
• No changes to the app build; pnpm analyze:* keep working as before

Non-goals

• Provider-specific billing logic (ledger/findings stay provider-agnostic)
• Publishing to anthropics/claude-plugins-community (separate decision after it works)

Docs: https://code.claude.com/docs/en/plugins.md, https://code.claude.com/docs/en/plugin-marketplaces.md, https://code.claude.com/docs/en/skills.md