Add CI check for HTTP MCP server URL liveness

Walks marketplace.json for vendored plugins, extracts http/sse MCP
server URLs from .mcp.json / mcp.json / plugin.json, and probes each
with HEAD then a JSON-RPC POST fallback. Fails on 404/410 and
connection errors; passes on auth/method errors (expected without
credentials). Runs on PR, daily schedule, and manual dispatch.

External (SHA-pinned) plugins are out of scope — their .mcp.json
isn't checked out here.

.claude-plugin/marketplace.json

@@ -18,7 +18,7 @@
         "source": "git-subdir",
         "url": "https://github.com/42Crunch-AI/claude-plugins.git",
         "path": "plugins/api-security-testing",
-        "ref": "v1.5.5",
+        "ref": "v1.0.1",
         "sha": "faf5305385de8afed9468904e8639be737aff39e"
       },
       "homepage": "https://42crunch.com"
@@ -1049,8 +1049,8 @@
       "source": {
         "source": "github",
         "repo": "jfrog/claude-plugin",
-        "commit": "259c8e718266c16e99b4f30ae9b1ed0f9f00d98d",
-        "sha": "259c8e718266c16e99b4f30ae9b1ed0f9f00d98d"
+        "commit": "761921eaa12b845beba1688d699a2d45091dfe83",
+        "sha": "d80db066e219aab8190f3dc4a463b71a3a180250"
       },
       "homepage": "https://jfrog.com"
     },
@@ -1654,8 +1654,7 @@
       "source": {
         "source": "url",
         "url": "https://github.com/RevenueCat/rc-claude-code-plugin.git",
-        "path": "revenuecat",
-        "sha": "407e4651ff74dbaf47c457948ab540e620403c2a"
+        "sha": "af7cb77996aee4e7e3c109c5afec81f716139032"
       },
       "homepage": "https://www.revenuecat.com"
     },
@@ -1676,8 +1675,7 @@
       "source": {
         "source": "url",
         "url": "https://github.com/RevenueCat/rc-claude-code-plugin.git",
-        "path": "revenuecat",
-        "sha": "407e4651ff74dbaf47c457948ab540e620403c2a"
+        "sha": "af7cb77996aee4e7e3c109c5afec81f716139032"
       },
       "homepage": "https://www.revenuecat.com"
     },
@@ -2009,8 +2007,7 @@
       "source": {
         "source": "url",
         "url": "https://github.com/sumup/sumup-skills.git",
-        "path": "providers/claude/plugin",
-        "sha": "a4b5a9789e10e27fb375b68279bb0916074b8dd4"
+        "sha": "0fd0a911ecaffd7187fe35e914d8ead6de584ffd"
       },
       "homepage": "https://www.sumup.com/"
     },
@@ -2250,8 +2247,7 @@
       "source": {
         "source": "url",
         "url": "https://github.com/zilliztech/zilliz-plugin.git",
-        "path": "plugins/zilliz",
-        "sha": "e960396da0bd0b1cb219fa97e3bcbb425ee1abbd"
+        "sha": "17cf04e6a3c272320b707d429484e4c00b3bec0b"
       },
       "homepage": "https://docs.zilliz.com"
     },

.github/workflows/bump-plugin-shas.yml

@@ -1,10 +1,8 @@
 name: Bump Plugin SHAs
 
-# Nightly sweep: for each external entry whose upstream HEAD has moved past
+# Weekly sweep: for each external entry whose upstream HEAD has moved past
 # its pinned SHA, validate at the new SHA with `claude plugin validate`
-# inline, then open one PR with all passing bumps. Each run force-resets the
-# bump/plugin-shas branch, so a previous night's unmerged PR is replaced (and
-# its review state discarded) — review and merge same-day to avoid churn.
+# inline, then open one PR with all passing bumps.
 #
 # Bot-free — uses the default GITHUB_TOKEN. PRs opened with GITHUB_TOKEN don't
 # trigger on:pull_request workflows, so the policy scan (`Scan Plugins`, a
@@ -16,7 +14,7 @@ name: Bump Plugin SHAs
 
 on:
   schedule:
-    - cron: '23 7 * * *'  # Daily 07:23 UTC
+    - cron: '23 7 * * 1'  # Monday 07:23 UTC
   workflow_dispatch:
     inputs:
       max_bumps: