Bump plugin version so installed copies actually receive the launcher fix

[walkerhughes]

The launcher fix in #3 never reached anyone, and this explains why the -32000 survived every update and reinstall.

What happened

Claude Code extracts an installed plugin to a cache path keyed by the manifest version:

~/.claude/plugins/cache/<marketplace>/<plugin>/<version>

#3 changed .mcp.json and added scripts/start-server.sh but left version at 0.1.0. So the cache key never changed and the extracted copy was never refreshed.

Observed on a live install after #3 merged:

Location	State
marketplaces/walkerhughes-mcps (git clone)	0637d00, has the launcher, command: bash
cache/.../harbor-mcp/0.1.0 (what actually runs)	no scripts/, command: uv
installed_plugins.json	version: 0.1.0, gitCommitSha: 2c1dfc2 (the commit from #2)

The marketplace fetch worked correctly. The extraction step is what was skipped. This failure mode is worse than a crash: nothing errors, users simply keep running old code.

Changes

• Version 0.1.0 to 0.2.0, which changes the cache key and forces a fresh extraction.
• Recovers the VIRTUAL_ENV fix that was pushed to Make harbor auth login the only auth path; snapshot the account at setup #3's branch after it had already merged, and was therefore orphaned. uv already ignores a mismatched VIRTUAL_ENV, but it warns loudly on stderr, and that warning already sent one debugging session chasing it instead of the real PATH problem.
• New plugin version workflow that fails any PR touching shipped plugin files without a version bump. harbor-mcp/tests/** and harbor-mcp/evals/** are excluded, since they are not copied into the plugin cache and cannot strand a user.
• Documents the rule in the root README.

Verification

The gate logic was exercised locally against this branch both ways:

A) version bumped to 0.2.0   -> base=0.1.0 head=0.2.0  -> PASS
B) simulated forgotten bump  -> base=0.1.0 head=0.1.0  -> FAIL (correctly blocks)

Launcher behavior, re-checked after the cherry-pick:

Check	Result
Foreign VIRTUAL_ENV set	0 warnings on stderr, 15 tools listed
env -i PATH=/usr/bin:/bin (the case that caused -32000)	initialize OK
uv absent from every candidate path	exit 127, 0 bytes on stdout, remediation on stderr

After merging

/plugin marketplace update walkerhughes-mcps will now land in a new 0.2.0 cache directory rather than reusing the stale 0.1.0 one.