feat: build one Agent Plugins package for several clients

The codex target builds an Agent Plugins package with one client profile
and one marketplace, and the agent-plugins target builds packages with
none. Codex, Copilot, VS Code and Cursor all read the format, so a plugin
built once can serve them all, given each client's marketplace file and
client-only files.

Add `clients` to the agent-plugins target (DEVPLAT-1558, ADR 0002):

- `clients: { codex: {}, copilot: {} }` writes each client's marketplace:
  Codex .agents/plugins/marketplace.json, Copilot
  .github/plugin/marketplace.json. `clients.<client>.manifest` and
  `plugins.<name>.clients.<client>.entry` are deep-merged into them. The
  shared `entry` and target `manifest` are config errors on agent-plugins
  that name the client-scoped field instead.
- Client-only kinds a listed client loads are selected by default and
  written to its extension directory: Copilot agents go to
  com.github.copilot/agents/, with .md, .markdown and .mdc renamed to
  NAME.agent.md. Any other file in agents/, or two files that land on
  the same path, fail the build.
- A client-only kind that no listed client loads stays a config error,
  and the message names the client that would load it. A file of such a
  kind that arrives another way, such as additionalFiles, fails the
  build. Client names are checked strictly, a client set to undefined
  counts as not listed, and `clients` is rejected on other targets.
- validate checks each client marketplace present: entries, including
  structured local Codex sources, must point at a package whose
  plugin.json has the same name. Copilot needs a marketplace owner, and
  its agents need NAME.agent.md names and valid frontmatter.
- src/package-clients.ts holds each client's namespace, marketplace,
  file placement and validation, with citations to the client docs.
- The engine gains two optional hooks, clientMarketplaces and placeFile.
  Other targets don't set them, and Glean's claude, cursor and codex
  output is byte-identical (191 files).

Verified end to end with the Glean plugin: Copilot CLI 1.0.100 and Codex
0.160.1 both install it from their marketplace in the same output.

Author: steve-calvert-glean

CONFORMANCE.md

@@ -44,7 +44,9 @@ against a temp fixture via [`bintastic`](https://github.com/scalvert/bintastic).
   deliberately **not** used here: Copilot derives from the Claude marketplace but
   extends entries (e.g. `mcpServers` as a `.mcp.json` path), which Claude's stricter
   schema rejects. Because it shares the Claude marketplace path, the `claude` and
-  `copilot` targets need separate output roots.
+  `copilot` targets need separate output roots. An `agent-plugins` target with
+  `clients.copilot` also writes `.github/plugin/marketplace.json`, so it needs an
+  output root separate from the `copilot` target's.
 - **antigravity** — covered structurally by the cross-target build test in
   `tests/core.test.ts` (required `plugin.json` fields present; optional
   `mcp_config.json` written when MCP servers are present). Antigravity CLI does
@@ -55,7 +57,13 @@ against a temp fixture via [`bintastic`](https://github.com/scalvert/bintastic).
   validator (`src/agent-plugins.ts`) re-implements the closed-schema checks
   without ajv, plus the semantic rules a JSON Schema can't express: skill names
   per the Agent Skills specification and matching their directory, and MCP
-  server rules from spec §7.2 and §9 (`src/mcp.ts`).
+  server rules from spec §7.2 and §9 (`src/mcp.ts`). With `clients`, the same
+  package oracle applies. The Codex marketplace uses the codex checks below,
+  and the Copilot marketplace and `com.github.copilot/agents/` layout are
+  asserted structurally against the
+  [Copilot CLI plugin reference](https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-plugin-reference)
+  (retrieved 2026-10-20), which publishes no schema. Client facts and their
+  citations live in `src/package-clients.ts`.
 - **codex** — the package half uses the Agent Plugins oracle above. The
   marketplace half is asserted structurally in `tests/conformance.test.ts` and
   `tests/core.test.ts` against the
@@ -74,8 +82,9 @@ against a temp fixture via [`bintastic`](https://github.com/scalvert/bintastic).
   added via `entry` is a structured object with an inner `source` discriminator
   (e.g. `{ source: "git-subdir", url, path, ref }`), validated by shape rather
   than requiring a local directory to exist. No published JSON Schema exists.
-  Codex shares no marketplace path with the other targets, so it needs no
-  separate output root.
+  Among the native targets, Codex shares no marketplace path, but an
+  `agent-plugins` target with `clients.codex` writes the same
+  `.agents/plugins/marketplace.json`, so the two need separate output roots.
 
 ## Update-check hook facts
 

CONTEXT.md

@@ -33,6 +33,10 @@ _Avoid_: portable plugin, AP plugin
 A client's additions to a package: its extension namespace, the manifest data under it, and the files in its extension directory.
 _Avoid_: overlay, flavor
 
+**Package client**:
+A client listed in the `agent-plugins` target's `clients`. One package serves every package client; each also gets its own marketplace file.
+_Avoid_: sub-target, flavor
+
 **Extension namespace**:
 The reverse-domain key a client owns inside a package, such as `com.openai`.
 _Avoid_: vendor key, client key

README.md

@@ -0,0 +1,34 @@
+---
+status: proposed
+---
+
+# One package for several clients
+
+Codex, GitHub Copilot, VS Code and Cursor all read Agent Plugins packages. A
+plugin built once as a package can serve all of them, if each client also gets
+its marketplace file and any client-only files. Before this change, the
+`codex` target built a package with one client's profile and marketplace, and
+the `agent-plugins` target built packages with none.
+
+We add `clients` to the `agent-plugins` target instead of adding a target per
+client or a list of clients to `codex`. Each listed client contributes:
+
+- a marketplace file at the path it reads (Codex
+  `.agents/plugins/marketplace.json`, Copilot `.github/plugin/marketplace.json`),
+- its client-only content kinds, written to its extension directory (Copilot
+  agents in `com.github.copilot/agents/`, renamed to `NAME.agent.md`).
+
+The package itself (`plugin.json`, `mcp.json`, `skills/`) is identical for
+every client, and the spec requires clients to ignore other clients'
+namespaces. So the output has no per-client copies of the package that could
+drift.
+
+Manifest data for a client goes under `manifest.extensions["<namespace>"]`
+explicitly. The `codex` target moves non-portable top-level fields into
+`com.openai` automatically, because it serves one client. A package that
+serves several clients can't know which one a field is for, so that stays a
+build error.
+
+The `codex` target stays for builds that serve only Codex, including
+`format: "legacy"`. Claude Code doesn't read Agent Plugins, so it isn't a
+package client; adding its manifest to the same directory is separate work.

docs/adr/0002-one-package-for-several-clients.md

@@ -93,10 +93,16 @@ so author it once. Don't add a per-target copy just to change
 (root `plugin.json` + `mcp.json`). Codex-only manifest fields such as
 `interface` move under `extensions["com.openai"]` automatically. Set
 `format: "legacy"` on the codex target only to keep the old
-`.codex-plugin/plugin.json` layout. The standalone `agent-plugins` target emits
-portable packages with no marketplace; it can't include `agents`, `commands`,
-`rules`, or `hooks`. Skill names must be lowercase letters, digits, and hyphens
-and match their directory, or Agent Plugins clients skip them.
+`.codex-plugin/plugin.json` layout. The `agent-plugins` target emits
+portable packages. Without `clients` it writes no marketplace and can't include
+`agents`, `commands`, `rules`, or `hooks`. With `clients: { codex: {}, copilot:
+{} }` it builds each package once and writes each client's marketplace. Listing
+`copilot` allows `agents`, which go to `com.github.copilot/agents/NAME.agent.md`;
+no client allows `commands`, `rules`, or `hooks`. Put client manifest data
+under `manifest.extensions["<namespace>"]`, and Codex `policy`/`category` under
+`plugins.<name>.clients.codex.entry`. Skill names must be lowercase letters,
+digits, and hyphens and match their directory, or Agent Plugins clients skip
+them.
 
 ## Verify