feat(plugins): add cix plugin + fix Bash grep/rg PreToolUse hook

[dvcdsys]

Summary

Brings the cix plugin source onto develop (it previously lived only on the now-deleted feat/claude-code-plugin branch) and fixes the PreToolUse hook so it actually fires for grep/rg invocations via the Bash tool — the common real-session shape.

Two commits for readable review:

1. feat(plugins): add cix plugin sources … — pure copy of the plugin tree from the local marketplace snapshot (74816e7), plus .claude-plugin/marketplace.json and .github/workflows/ci-plugin.yml. No behavior change.
2. fix(plugins/cix): match Bash grep/rg in PreToolUse hook — the actual fix + tests + docs.

Root cause

hooks.json declared "matcher": "Grep|Glob". PreToolUse matchers match on tool_name, not on tool_input.command, so Bash invocations (which is where Claude runs grep -rn …, rg …, cat | grep | head, cd && grep …) were silently never matched. The grep-nudge.sh script itself was healthy — confirmed via a manual repro: invoking the script with a fake PreToolUse payload produced the expected additionalContext JSON, while a real grep -rn through Bash in a session emitted nothing.

Fix

• hooks.json gains a second PreToolUse entry with "matcher": "Bash" pointing at the same script. Split into two entries (rather than "Grep|Glob|Bash") so each path's intent reads clearly.
• grep-nudge.sh inspects tool_name; for Bash it parses tool_input.command and only proceeds when the command contains a standalone grep-family token (grep/egrep/fgrep/rg/ripgrep). Non-grep Bash exits silently before the backoff counter increments, so the 1/2/4/8/16 cadence is preserved.
• tests/manifest.bats pins the matcher list: dropping Bash or Grep from hooks.json now fails CI — the exact regression that produced this PR.
• tests/grep-nudge.bats grows 14 cases: grep/rg/ripgrep/egrep/fgrep, pipelines, chained commands, git grep (intentionally nudges), grepl substring rejection, and the no-fire set (ls/git status/make/go test/Read tool).
• README troubleshooting bullet documents the failure mode + the manifest guard.

Without jq the Bash branch is silent rather than parsing shell commands with sed — false-positive risk too high. jq is already in the CI image and listed as a dev dependency.

Test plan

• bats plugins/cix/tests/*.bats → 60/60 green locally (18 pre-existing grep-nudge + 14 new Bash + 5 new manifest + 23 other hook tests unchanged)
• shellcheck --severity=warning plugins/cix/scripts/*.sh → clean locally
• CI Plugin Tests workflow green on Linux + macOS (runs bats + shellcheck + JSON validation + symlink check)
• Manual repro after merge:
  • Reinstall the plugin so the cache picks up new hooks.json/grep-nudge.sh
  • In a cix-indexed project, ask Claude to run grep -rn Foo . — tool result must include the cix search nudge
  • Same session: ls -la, git status, make test — no nudge, no counter bump