Marketplace: derive the plugin slug from the id only (final review M4)

The slug (plugin marketplace "triple-c-<slug>", plugin tree
"plugins/<slug>/") was built from the editable display name. After a
rename the next sync registered the new marketplace, skipped the plugin
install because the state's commit matched, then removed the old
marketplace: the plugin was gone while the report said nothing changed.

marketplace_slug now takes the id only ("mp-<id8>"). With plugin state
kept per slug (I1), containers synced with the old "<name>-<id8>" slugs
move over on their next sync: plugins are installed under the new name,
the old copies uninstalled and the old registration dropped. A sync
script test covers that migration (it fails on the pre-I1 script).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/src-tauri/src/marketplace/payload.rs

@@ -200,7 +200,7 @@ pub fn build_payload(input: &PayloadInput) -> Result<Payload, String> {
                     }
                 };
                 entry["source"] = json!(format!("./{key}"));
-                let slug = marketplace_slug(&m.name, &m.id);
+                let slug = marketplace_slug(&m.id);
                 for f in &files {
                     tar.file(
                         &format!("plugins/{slug}/{key}/{}", f.rel_path),
@@ -328,7 +328,7 @@ mod tests {
 
         assert!(p.skipped.is_empty(), "{:?}", p.skipped);
         let files = unpack(&p.tar);
-        let slug = marketplace_slug("Team Tools", "m1aaaaaaaa");
+        let slug = marketplace_slug("m1aaaaaaaa");
         for path in [
             "agents/code-reviewer.md".to_string(),
             "skills/example-skill/SKILL.md".to_string(),
@@ -367,7 +367,7 @@ mod tests {
             data_root: data.path(),
         })
         .unwrap();
-        let slug = marketplace_slug("Team Tools", "m1aaaaaaaa");
+        let slug = marketplace_slug("m1aaaaaaaa");
 
         let files = unpack(&p.tar);
         let manifest: Value = serde_json::from_slice(&files["manifest.json"].data).unwrap();
@@ -398,6 +398,32 @@ mod tests {
         assert_eq!(catalog["plugins"][0]["source"], "./example-plugin");
     }
 
+    /// Final review M4: the plugin marketplace name comes from the id, so a
+    /// rename never makes the container see a different marketplace.
+    #[test]
+    fn plugin_slug_survives_a_rename() {
+        let Some(fx) = GitFixture::new() else { return };
+        let c = fx.with_all_kinds();
+        let data = tempfile::tempdir().unwrap();
+        cache(&fx, data.path());
+        let installs = vec![inst(ItemKind::Plugin, "example-plugin", &c)];
+        let slug_named = |name: &str| {
+            let marketplaces = vec![Marketplace {
+                name: name.into(),
+                ..market("m1aaaaaaaa")
+            }];
+            let p = build_payload(&PayloadInput {
+                installs: &installs,
+                marketplaces: &marketplaces,
+                data_root: data.path(),
+            })
+            .unwrap();
+            p.manifest["items"][0]["slug"].as_str().unwrap().to_string()
+        };
+        assert_eq!(slug_named("Team Tools"), "mp-m1aaaaaa");
+        assert_eq!(slug_named("Renamed"), "mp-m1aaaaaa");
+    }
+
     #[test]
     fn items_that_cannot_be_built_are_skipped_not_fatal() {
         let Some(fx) = GitFixture::new() else { return };