chore: re-lock SDK 0.4.1, pin nightly action SHAs, fix stale docs

[chiruu12]

Hygiene pass from the cross-repo review.

Changes

• uv.lock: re-locked editable SDK 0.4.0 → 0.4.1 (picks up the new integration-extra metadata published in unplug-ai 0.4.1). CI uses --no-sources, so this is local-parity only.
• nightly-editable-sdk.yml: pinned actions/checkout, astral-sh/setup-uv, actions/setup-python to commit SHAs (same SHAs already used in ci.yml) — was floating on @v6/@v7.
• MARKETPLACE.md: post-release verification 0.1.1 → 0.1.3.
• CLAUDE.md: dependency note unplug>=0.2.0 → unplug-ai>=0.4.0,<0.5.

No code or behavior change. Remaining MCP findings (internal unplug.core.agent.boundaries import, broken unplug-test-agent entry point, shared-Guard concurrency) are tracked separately.

[greptile-apps]

Greptile Summary

This PR updates release and dependency hygiene. The main changes are:

• Pins the nightly workflow actions to commit SHAs.
• Updates the SDK dependency note to unplug-ai>=0.4.0,<0.5.
• Updates marketplace verification to unplug-mcp==0.1.3.
• Refreshes uv.lock metadata for unplug-ai 0.4.1.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
.github/workflows/nightly-editable-sdk.yml	Pins nightly workflow actions to release commit SHAs already used by the CI workflow.
uv.lock	Refreshes the editable unplug-ai lock metadata from 0.4.0 to 0.4.1 and adds the new integration extras metadata.
CLAUDE.md	Updates the SDK dependency note to match the current unplug-ai package name and version range.
MARKETPLACE.md	Updates the post-release verification command to the current unplug-mcp version.

_{Reviews (1): Last reviewed commit: "chore: re-lock 0.4.1, pin nightly SHAs, ..." | Re-trigger Greptile}