Closes #1403–#1407 · Milestone #116

# Lane 2 — CI/Tooling De-noise

Every PR rollup state should mean what it says

## #1403 claude-review label gate

Workflow no longer auto-runs+cancels on every PR; runs only when labeled `needs-claude-review`.

- .github/workflows/claude-review.yml
- workflow_dispatch + @claude comment paths preserved

## #1404 docs.yml job rename

Lowercase `build` in docs.yml renamed to Docs Site Build — no longer confusable with required Build from build.yml.

- .github/workflows/docs.yml
- job key stable (no cross-workflow refs)

## #1405 postbuild collapsed

Stamp-counts now runs inside build-plugins.sh before the summary prints. One phase, accurate counts on first run.

- scripts/build-plugins.sh
- package.json (postbuild simplified)

## #1407 version auto-sync

stamp-counts.sh propagates package.json version to 6 sibling files; validate-counts catches any drift.

- scripts/stamp-counts.sh (new sync_versions)
- bin/validate-counts.sh (new version drift check)

## #1406 mdx guard relocated

Guard moved into docs/site/scripts/. Root devDeps lose @mdx-js/mdx + remark-gfm — 128 transitive packages dropped.

- docs/site/scripts/test-mdx-compile.mjs
- docs/site/tests/fixtures/nested-fence.mdx
- tests/unit/test-mdx-compile.sh (paths)

The biggest single win — version sync

## Before vs after — bumping a release

❌ Before — manual sync, 7 files

    # bump:
    $ vim package.json                  # 7.55.0 → 7.56.0
    $ vim pyproject.toml                # forget? CI fails
    $ vim manifests/ork.json
    $ vim .claude-plugin/marketplace.json
    $ vim plugins/ork/.claude-plugin/plugin.json
    $ vim CLAUDE.md
    $ vim .release-please-manifest.json
    $ npm run build && commit && push
    $ CI fail: pyproject.toml drift
    $ vim pyproject.toml && commit && push   # round 2

→ Bit us on PR #1399 + #1402 (pyproject.toml forgotten)
✅ After — single source of truth

    # bump:
    $ npm version minor                 # 7.55.0 → 7.56.0
    $ npm run build
      Stamping counts and version markers…
      Version: 7.56.0 synced across 6 sibling files
    $ git commit -am "chore: bump 7.56.0"
    $ git push
    $ CI green

→ One file edited, build does the rest
Rollup signal — before vs after

## What reviewers see on a clean PR

PR rollup state
UNSTABLE→CLEAN
Non-required reds
2→0
Diagnose-failure cycles
~3→1
Files to bump on release
7→1
Root devDep count
3→1
Build phases
2→1

## Local verification (all green)

- npm run build → single-phase, accurate counts on first run
- bin/validate-counts.sh → version sync passes (all 6 files at 7.55.0)
- npm run test:mdx → 253 mdx files compile + counter-example rejected
- npm run test:agents → 37/37 valid
- npm run test:manifests → 106/106 skills delivered
- npm run test:security → 12/12 passed
- YAML validates on both edited workflows