Problem

jaine-sync plugins reject <name>@<vendor-mp> silently fails for all vendor marketplaces:

reject@jaine-plugins: ✓ works
reject@browserbase: ✗ BROKEN (repo_path=None)
reject@claude-code-lsps: ✗ BROKEN (repo_path=None)
reject@signoz-skills: ✗ BROKEN (repo_path=None)

6 plugins already rejected via manual workaround instead of the command:

• browserbase: functions, browserbase-cli
• claude-code-lsps: ada-language-server, bsl-lsp, omnisharp, powershell-editor-services

Additionally, ensure_merge_protection short-circuits for browserbase (single-plugin repo) → marketplace.json merge=ours never written → upstream changes will silently override curation.

Root cause

get_repo_path_for_marketplace(mp) looks up manifest.marketplaces only. Vendor marketplaces use Repo.linked_marketplace field — different convention, different lookup.

ensure_merge_protection guard requires plugins/ or external_plugins/ dir. Single-plugin repos (source: "./") have neither.

Context

Original issue: #152 (closed, superseded). Primary pain points from #152 already solved:

• CalVer display → v3.45.2 (PR #160)
• Auto-bump SHA → v3.46.0 (PR #161)

This issue covers the REMAINING architectural gaps only.

Design

Spec: docs/superpowers/specs/2026-04-22-marketplace-curation-unification-design.md (v2)

3 phases, 1 PR, ~40 min:

Phase 1 — Schema + lookup

• Add linked_marketplace: jaine-plugins to claude-plugins-official in manifest.yaml
• Update get_repo_path_for_marketplace: try repos[*].linked_marketplace first, fallback to manifest.marketplaces

Phase 2 — Verify reject e2e

• Tests that reject@browserbase edits marketplace.json, commits, pushes, refreshes CC cache
• No code changes beyond Phase 1

Phase 3 — Merge protection guard

• Extend guard: trigger if .claude-plugin/marketplace.json exists at repo root (not only plugins/ dir)
• browserbase gets marketplace.json merge=ours on next sync

Acceptance criteria

• get_repo_path_for_marketplace('browserbase') → returns vendor repo path
• reject <name>@browserbase works end-to-end
• ensure_merge_protection writes marketplace.json merge=ours for browserbase
• All existing tests pass

Deferred (from original #152)

• CLI rename vendor→repo (cosmetic, functional as-is)
• Orphan detection for vendor marketplaces (no cases yet)
• Upstream alerts for vendor marketplaces (no upstream changes since fork)
• Lifecycle for primary (semantic mismatch — dropped in brainstorm)