chore: dual-host plugin (Claude + Codex) via Node.js MCP bridge

[firstintent]

What

Same repo now serves as both a Claude Code plugin and a Codex plugin. A zero-npm-dep Node.js bridge (index.js) handles binary lazy download + host detection + stdio proxy to ccteam mcp-serve.

Why

• Single-command install: /plugin install ccteam (Claude) or codex plugin marketplace add firstintent/ccteam (Codex). No install.sh required, no ~/.local/bin/ PATH wrangling.
• Binary in plugin sandbox = PATH-independent; bridge auto-symlinks to ~/.local/bin/ccteam so terminal ccteam start still works.
• CCTEAM_HOST env injected → Rust binary can branch behavior per host (V0.6.7 candidate; this PR does not act on it).
• install.sh kept as system-wide CLI fallback for headless / non-Claude/Codex workflows; README + quickstart lead with the plugin path.
• Version SoT = .claude-plugin/plugin.json::version — index.js reads it at startup and re-downloads the binary whenever ccteam --version does not match; no hardcoded version strings inside the bridge.

Architecture

/plugin install ccteam  (Claude)   or   codex plugin marketplace add firstintent/ccteam
   |
   v Anthropic / Codex protocol clones repo + registers .mcp.json
   |
   v user calls any mcp__ccteam__* tool
   |
   v host spawns `node ${PLUGIN_ROOT}/index.js`
       |
       v index.js sniffs host (CLAUDE_PLUGIN_ROOT vs CODEX_ACTIVE/PLUGIN_ROOT env)
       v checks ${PLUGIN_ROOT}/bin/ccteam exists + version matches plugin.json
       v if missing/stale: download ccteam-vX.Y.Z-<platform>.tar.gz from GH Release
                          extract via `tar -xz --strip-components=1` -> ${PLUGIN_ROOT}/bin/
                          chmod +x, symlink ~/.local/bin/ccteam -> ${PLUGIN_ROOT}/bin/ccteam
       v soft-warn if tmux not on PATH (chat-mode features unavailable)
       v exec ccteam mcp-serve with env CCTEAM_HOST=claude|codex
       v pipe stdin/stdout (stderr passes through to host for diagnostics)

Files

• New: index.js (218 LOC, zero npm deps — stdlib only), .codex-plugin/plugin.json (rich Codex UI metadata: interface block, brandColor, defaultPrompt).
• Modified: .mcp.json (command: ccteam -> node ${CLAUDE_PLUGIN_ROOT}/index.js), .claude-plugin/plugin.json + .claude-plugin/marketplace.json (version drift 0.6.5 -> 0.6.6, matching workspace SoT — no workspace bump), README.md (lead with plugin install, install.sh demoted to "Advanced"), docs/quickstart.md (Step 1 rewritten: no CLI prereq; Codex sub-section added), docs/troubleshooting.md (3 new entries A3b/A3c/A3 update: bridge download failures, missing PATH symlink).

Verify

• node --check index.js -> clean
• JSON validity (all 4 manifests: .claude-plugin/plugin.json, .claude-plugin/marketplace.json, .codex-plugin/plugin.json, .mcp.json) -> clean
• cargo clippy --workspace --all-targets --locked -- -D warnings -> 0 warnings (no Rust touched)
• cargo fmt --all -- --check -> clean
• sh -n install.sh && dash -n install.sh -> clean
• Baseline cargo test --workspace --locked --no-fail-fast -> 1545 passed, 95 failed; all 95 failures pre-exist on origin/main (ccteam-web SSE / SPA / webhook integration tests, env-dependent — port binding / 502 on this WSL host); zero new failures introduced (no Rust source modified).

Test plan

• Tag a v0.6.6 release once merged so the GH Release tarballs exist (current firstintent/ccteam has no release yet; bridge needs assets to download).
• Verify on Linux x86_64: /plugin install ccteam in a fresh Claude session, call any mcp__ccteam__* tool, confirm ~/.local/bin/ccteam appears.
• Verify on macOS arm64: same as Linux + Gatekeeper bypass.
• Verify in a Codex session: codex plugin marketplace add firstintent/ccteam, confirm bridge picks CCTEAM_HOST=codex.
• Manual fallback: if ${CLAUDE_PLUGIN_ROOT} env is not substituted by the host, switch .mcp.json to absolute path and re-test.