docs: two citations pointed at the sibling repo, and the version badge froze nine releases ago

[fdaviddpt]

Closes #333
Closes #335

#333 — hooks.d/before_session_start/50-git-restore.sh:313 and tests/test_git_restore_hook_253.py:463 both cited docs/validators.md, which belongs to claude-supertool and has never existed here. The three-state contract they were pointing at is real and does live in this repo, just elsewhere: the 0.12.0 CHANGELOG entry states it, and _push_and_report in hooks.d/after_save/50-git-backup.sh implements it. Both citations now point there. Swept for other cross-repo path references — none remain.

#335 — the README badge read 0.8.3 while the manifest declared 0.18.0. Nine releases, on the front page, hyperlinked to the very file it disagreed with.

The bump is five seconds; the durable half is why it went unnoticed for nine releases. A release sweep keyed on the version being replaced only finds sites that are mid-bump — a zero from it means "nothing is half-done", never "everything is right". It is structurally incapable of seeing a field frozen at some third value, which is exactly the field most likely to be wrong.

So test_readme_version_badge_matches_code joins the guards, and it fails on an unmatched pattern rather than passing. A regex that finds nothing has not checked the badge — that distinction is the whole point of the test.

RED:

AssertionError: README.md's version badge reads 0.8.3 but .claude-plugin/plugin.json declares 0.18.0.
assert '0.8.3' == '0.18.0'

GREEN: tests/test_version_manifest.py: 5 passed

Chose the static bump plus a pinning test over the shields.io dynamic-JSON badge the issue also floated — the dynamic one trades a silent drift for a runtime dependency on shields.io resolving a raw GitHub URL, and the test makes drift structurally impossible anyway. CI fails; it does not merely miss it.

Full suite run locally before push: green.