fix: correct release trust and onboarding metadata

[gael55x]

Problem

Grape 1.0 shipped with two release-trust defects:

• The packaged Codex plugin declared version 0.1.0 and linked to graperoot.dev, an unrelated product that advertises a different installer.
• An active session guide still told stable users to install grape-context@beta, which currently resolves to beta.9 instead of latest=1.0.0.

The README also presented repo-local Codex marketplace commands as normal onboarding even though those commands require a Grape source checkout. Public npm metadata had no focused discovery keywords.

Root cause

The plugin check hardcoded the stale plugin version and did not validate homepage ownership or package-version alignment. Beta-era operational guidance survived the stable release because active onboarding had no release-consistency check.

Changes

Plugin trust

• Align the Codex plugin version with package.json.
• Replace unrelated homepage links with the Grape GitHub README.
• Make plugin:check reject future version, homepage, repository, and website drift.

Stable onboarding

• Replace active @beta install and recovery commands with the stable package.
• Mark repo-local Codex plugin commands as contributor-only source-checkout workflows.
• Add a docs gate that rejects beta install guidance and pre-1.0 wording in active release docs.
• Preserve the existing README tagline after review feedback.

Discovery

• Clarify the npm package description around local repository context continuity.
• Add focused npm keywords without adding dependencies or broadening runtime claims.

Behavioral comparison

Before	After
Plugin version 0.1.0	Plugin version matches package 1.0.0
Plugin website points to an unrelated product	Plugin website points to the Grape repository
Stable guide installs @beta	Active guide installs latest
Source-only plugin commands look like end-user setup	Direct Codex installer remains the normal path
Generic package metadata with no keywords	Narrow package description and focused keywords

Validation

• npm run check: passed on the combined branch, including 456 of 456 behavior tests
• npm run package:check: passed
• npm run plugin:check: passed
• Plugin schema validator: passed
• npm run docs:check: passed again after the final README review change
• npm run benchmark:run: all seven existing fixtures passed on synchronized main before edits
• npm run e2e:alpha: passed
• npm run test:connect: packed CLI and MCP trial passed
• npm audit --audit-level=low: zero known vulnerabilities
• Documentation privacy and style scan: no personal paths, private workspace names, absolute temporary paths, or banned punctuation in changed docs

The packed-package baseline is 237,262 bytes compressed and 1,141,779 bytes unpacked across 316 files.

Benchmark limits

The existing fixtures show same-session body reduction and invalidation behavior, but they do not prove real-agent token savings, production-scale performance, or superiority over external tools. Those claims remain intentionally out of scope.

Risks and tradeoffs

• This PR does not change runtime, storage, or MCP behavior.
• CHANGELOG.md may need a small conflict resolution if PR chore: capability audit with transport and scalability fixes #15 lands first.
• The corrected metadata requires a patch release before npm users receive it.
• Plugin and npm package versions now move together. Independent plugin versioning would require an explicit release policy.

Remaining follow-ups

PR #15 is merged into main and included in this branch through merge commit 45a443b. It owns unchanged-turn self-invalidation, warm MCP marker payload reduction, Git output limits, and bootstrap snapshot duplication.

Validated follow-up work still needs separate design or evidence:

• bound snapshot-wide state growth and make retention effective
• recover safely from abandoned session locks
• enforce MCP lifecycle negotiation and pre-initialize ordering
• record real Codex, Claude, and Cursor activation and session-continuity trials
• choose and publish a maintainer-controlled private security-reporting path

Adoption implications

This removes two trust-breaking onboarding defects and improves npm discovery without changing the approved README tagline. Broader promotion should wait for this combined branch to ship in a verified patch release.