fix(claude-code): update plugins on every init-plugins.sh run

[gatezh]

What

After its install loop, init-plugins.sh now refreshes the marketplace indexes and runs claude plugin update for each bundled plugin. The change applies to both the claude-code template copy and the repo-root copy.

Why

~/.claude is a named volume that survives rebuilds, and claude plugin install is a no-op for a plugin that's already installed. As a result, plugin versions froze at whatever was latest when the volume was created, and Rebuild Container never updated them. #158 caught modern-web-guidance 19 releases behind, with its own CLI complaining that it was out of date.

Changes

• claude-code/.devcontainer/init-plugins.sh:
  • claude plugin marketplace update, with no name, which refreshes all marketplaces, followed by claude plugin update "$plugin" for each plugin.
  • Each step uses the script's existing ✔/⚠ output and can't abort the script under set -euo pipefail.
• .devcontainer/init-plugins.sh: the same pass, in that script's Note: output style.
• claude-code/README.md:
  • The init-plugins section now mentions the update pass.
  • Adjacent fix in the same section: "four marketplaces" is now five, and the missing cloudflare/skills / cloudflare row is added to the bundled-plugins table.

Notes

• CLI contract is confirmed from both code.claude.com/docs (plugins-reference) and --help in claude-code:latest (2.1.278):
  • plugin update <plugin> takes a required name@marketplace argument, and its --scope defaults to user, the same as install.
  • plugin marketplace update [name] updates all marketplaces when no name is given.
  • The marketplace refresh has to come first. Otherwise update resolves against the cached index and no-ops, as [BUG] init-plugins.sh never updates plugins — install no-ops against the persistent ~/.claude volume #158 showed.
• Verification (in claude-code:latest):
  • Two back-to-back runs both exit 0; the second reports every plugin "already at the latest version".
  • plugin update nope@nowhere exits 1, which is caught by the ⚠ branch.
  • With --network none, each update prints ⚠ and the script keeps going.
  • shellcheck and actionlint are clean.
• Not verified: a real old-to-new upgrade, because a stale install couldn't be faked locally. That path rests on [BUG] init-plugins.sh never updates plugins — install no-ops against the persistent ~/.claude volume #158's evidence from a real container (0.0.170 → 0.0.189).
• Pre-existing and out of scope: with no Playwright plugin cache (e.g. offline), /usr/local/bin/patch-playwright-mcp exits non-zero and aborts the claude-code init-plugins.sh under set -e. The unmodified script behaves the same way. Worth a separate issue.
• Merge order: fix(claude-code): fix template lifecycle wiring and persist gh config #165 also edits the init-plugins.sh header and the README's init-plugins section. Whichever merges second needs a small rebase.

Fixes #158