Marketplace sync: keep installs the host could not build (final review M3)

An install the host skipped (pinned commit missing from the cache, cache
unreadable, item failing a tightened validation rule) never reached the
manifest, so sync.sh treated it as deselected and deleted it from the
container. The manifest now carries `held`: the state ids of such
installs ("plugin:<slug>/<key>" for plugins). The script counts them as
still selected and carries their records forward, as it already does
for items that fail inside the container. A removed marketplace is the
one skip that still removes; a malformed `held` list changes nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/superpowers/specs/2026-09-27-marketplace-design.md

@@ -233,7 +233,8 @@ in existing projects. Plugin commands additionally run under `flock /tmp/.triple
 agents/<file>  skills/<dir>/…  commands/<file>  hooks/<dir>/…
 plugins/.claude-plugin/marketplace.json   # generated: only selected plugins
 plugins/<plugin>/…                         # each at its own pin
-manifest.json                              # effective set: kind, key, marketplace, commit, hook JSON
+manifest.json                              # effective set: kind, key, marketplace, commit, hook JSON;
+                                           # `held`: ids the host could not build this time (kept as is)
 ```
 
 uploaded to `~/.claude/triple-c/marketplace/incoming/` together with the sync script itself and