Marketplace sync script: review fixes (round 2)

Removal only derives a path from an exact <kind>:<key> state id with a known
kind; any other record is dropped with an error and nothing is deleted
(an id like "skill" used to remove ~/.claude/skills/skill). Invalid plugin
records are dropped too, and a failed chmod 600 on settings.json is reported.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/src-tauri/src/marketplace/sync_script_tests.rs

@@ -851,3 +851,36 @@ fn sync_settings_move_failure_is_reported_and_not_recorded() {
         "{state}"
     );
 }
+
+#[test]
+fn sync_drops_state_records_without_a_kind_key_id() {
+    let Some(env) = env() else { return };
+    install_all(&env);
+    let claude = env.home.join(".claude");
+    let mine = [
+        claude.join("skills/skill/SKILL.md"),
+        claude.join("agents/agent.md"),
+    ];
+    for p in &mine {
+        fs::create_dir_all(p.parent().unwrap()).unwrap();
+        fs::write(p, "mine\n").unwrap();
+    }
+    let state_path = claude.join("triple-c/marketplace/state.json");
+    let mut state = read_json(&state_path);
+    for bogus in ["skill", "agent", "widget:x", "agent:a:b", "plugin:a:b"] {
+        state["items"][bogus] = json!({ "commit": C1, "path": "/" });
+    }
+    fs::write(&state_path, state.to_string()).unwrap();
+
+    payload(&env, &[], empty_manifest());
+    let r = run(&env);
+
+    assert_eq!(sorted(r.removed.clone()).len(), 4, "{r:?}");
+    assert_eq!(r.errors.len(), 5, "{r:?}");
+    assert!(claude_log(&env).is_empty(), "{:?}", claude_log(&env));
+    for p in &mine {
+        assert_eq!(fs::read_to_string(p).unwrap(), "mine\n", "{}", p.display());
+    }
+    let state = read_json(&state_path);
+    assert_eq!(state["items"], json!({}), "bogus records dropped");
+}