Sync third-party and MCP marketplace plugins

Constraint: Public skills are published only by explicit administrator action unless they are tracked third-party market sources.
Confidence: high
Scope-risk: narrow
Directive: Keep private/internal skills out of the public marketplace and preserve normal incremental market Git history.
Tested: Marketplace validation passed.

scripts/sync_external_plugins.ps1

@@ -752,7 +752,14 @@ function Get-Clone {
     $apiRoot = if ($provider -eq "github") { "https://api.github.com" } else { "https://$repoHost/api/v1" }
     $release = Invoke-RestMethod -Uri "$apiRoot/repos/$owner/$repoName/releases/latest" -Headers @{ Accept = "application/json"; "User-Agent" = "skill-market" } -TimeoutSec 30
     $tag = [string]$release.tag_name
-    if ($release.draft -or $release.prerelease -or $tag -notmatch '^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$') {
+    $versionPattern = '^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)'
+    if ($Source.PSObject.Properties.Name -contains 'releaseTagSuffix') {
+      $suffix = [string]$Source.releaseTagSuffix
+      if ($suffix -cnotmatch '^[A-Za-z][A-Za-z0-9-]*$') { throw 'Invalid releaseTagSuffix' }
+      $versionPattern += '(?:-' + [regex]::Escape($suffix) + '(?:\.(?:0|[1-9]\d*))*)?'
+    }
+    $versionPattern += '$'
+    if ($release.draft -or $release.prerelease -or $tag -cnotmatch $versionPattern) {
       throw "Invalid stable release tag: $tag"
     }
     $Source | Add-Member -NotePropertyName ref -NotePropertyValue $tag -Force