chore: update validation workflow and scripts for README and manifest versions

[birosrichard]

Extend generate_agents.py to check README and manifest versions

agents/AGENTS.md is generated and marketplace.json is validated in CI, but two other hand-maintained surfaces had no guard at all, and both had already drifted:

• gemini-extension.json was on 1.0.0, while plugin.json and marketplace.json were on 2.0.0. Fixed here.
• The README skills table and its Skills-N badge are updated by hand. Nothing stops a new skill from landing without them.

The script already walks these files, so it now checks them too.

Changes

• validate_readme compares the skill names in the ## Skills table against skills/*/SKILL.md in both directions, and checks the badge count (URL and alt text). Only names and counts, not the prose: the table copy is hand-written and better than the SKILL.md descriptions, so it stays human.
• validate_versions — asserts one shared version across plugin.json, gemini-extension.json, marketplace.json metadata, and each per-plugin version in marketplace.json (those are what users actually install).
• All checks now run before exiting, so one CI run reports everything that needs fixing instead of one problem per round.
• Workflow paths now include README.md, plugin.json and gemini-extension.json; otherwise, a PR touching only those files would skip validation entirely.

This is part of the #75

[marekh19]

@claude /code-review

[marekh19]

Unrelated to this PR, but since it's about trusting these guards: the "not covered by any plugin" loop (lines 108–116) has been dead since apify-actor-commands got "source": "./". lstrip is a character-set strip, so "./".lstrip("./") is "", and every skill path starts with "".

[marekh19]

## Skills isn't the README's only hand-maintained skill list — ## Installation (README:100–104) repeats all five names as /plugin install <name>@apify-agent-skills.

I added a skill and wired it into the table, badge, and marketplace.json, leaving only the install block stale: the validation passed OK. That's the same drift this PR closes, one section further down.

re.findall(r"^/plugin install ([a-z0-9][a-z0-9-]*)@", ...) against the same discovered set covers it.

[marekh19]

This keys on the backticks rather than the entry, which cuts both ways. Removing them from one otherwise-correct row fails with "Skill 'apify-actorization' is missing from the README '## Skills' table" — a formatting tweak breaks CI with a message pointing at the wrong thing. And a row can link to a folder that doesn't exist (skills/does-not-exist/) and still pass, because the link target is never read.

Keying on the target instead fixes both:

Suggested change

	listed = set(re.findall(r"^\|[^|]*`([a-z0-9][a-z0-9-]*)`", section.group(1), re.MULTILINE))
	listed = set(re.findall(r"^\|[^|]*\]\(skills/([a-z0-9][a-z0-9-]*)/?\)", section.group(1), re.MULTILINE))

Same five names on the current README, works with or without backticks, and it catches the broken link.

[marekh19]

"All checks now run before exiting" holds only while all three return normally. They're evaluated eagerly inside the tuple, before anything prints, so an exception in one discards what the others already found.

Malformed JSON in gemini-extension.json — one of the hand-edited files this PR is here to guard — raises out of validate_versions at line 182. I hit it with an unlisted skill also present: CI shows a JSONDecodeError traceback and never prints the README errors.

Wrapping the call in try/except Exception and turning the crash into one more error line keeps the promise for whatever check gets added next.