chore: address Copilot review round 6

- verify-skills: the best-effort `plugin validate` hand-off now also requires
  the EXACT pinned CLI. `local:gate` runs `validate` before the pinned
  `verify:skills:cli` step, so a newer local CLI could reject skills that CI's
  pinned validator accepts — and the gate would exit there, never reaching the
  reproducible check. One schema everywhere, or none.
- Dropped `PLUGIN_VALIDATE_MIN_VERSION`: with both validators on the exact pin
  it was read only by its own test, and a constant nothing enforces is a claim
  nothing enforces. Its test now pins what actually matters — that equality is
  distinguishable from newer as well as older.
- The CI step's comment described the old floor behavior.
- issue-create: the duplicate check searched only open issues, so a completed or
  rejected match was invisible to a procedure that says never to duplicate.
  Searches all states and reports state/stateReason.

Signed-off-by: cliffhall <cliff@futurescale.com>

.github/workflows/main.yml

@@ -60,9 +60,12 @@ jobs:
         # would mean always, in CI. Installing it here is what makes the
         # acceptance criterion true rather than aspirational.
         #
-        # The script resolves the CLI itself — an installed one when it is new
-        # enough, otherwise a PINNED one via `npx -y` — so this is the same
-        # command `npm run local:gate` runs, and the two cannot drift. Pinned
+        # The script resolves the CLI itself — an installed one ONLY when it
+        # matches the pin exactly, otherwise the pinned package via `npx -y` —
+        # so this is the same command `npm run local:gate` runs, and the two
+        # cannot drift. Exact rather than a floor: a newer local CLI is a
+        # DIFFERENT schema, which is how a "reproducible" gate starts disagreeing
+        # across machines. Pinned
         # rather than @latest: an unpinned validator can start failing a PR that
         # changed nothing. It needs no authentication — verified with a clean HOME.
         run: npm run verify:skills:cli