Scope guard: a non-member PR may only ADD marketplace.json entries whose source repo already backs a live plugin here. - changes files other than .claude-plugin/marketplace.json: partner-built/xquik/.claude-plugin/plugin.json, partner-built/xquik/.mcp.json, partner-built/xquik/LICENSE, partner-built/xquik/README.md, partner-built/xquik/skills/x-research/SKILL.md - added "xquik" has no source.url to validate