fix(install-plugins): guarantee npm present, not just node>=22

BLK-013 fix-forward. Step 1 checked `node >=22` but never verified npm.
On a host where node was already recent, NODE_OK short-circuited the
installer and npm was never touched — yet GSD (gsd-pi) and ctx7 install
via `npm install -g`, so a missing npm made `make plugin` die Error 127
mid-run (distro `apt install nodejs` can ship npm as a separate package).

Add an unconditional npm guard right after the Node block:
corepack enable npm → distro package-manager install fallback → fatal
exit 1 with an actionable message if still absent. Happy path (npm
present) skips the whole block: zero behavior change on healthy machines.

shellcheck clean (only pre-existing SC1091 infos), bash -n OK. Fresh
npm-less apt host validation still pending. Closes TODO (a) 2026-06-30.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VeBXkDr74N9whdiJyjzyVN

.claude/tasks/TODO.md

@@ -389,6 +389,7 @@ Aucun mécanisme n'intercepte le message utilisateur pour *lancer* un skill. La
 Tension réelle proactif vs intrusif. Auto-déclencher feat/bugfix sur intention CLAIRE et non-ambiguë = sain. « Déclenche tout skill jugé pertinent » = RISQUÉ (faux déclenchements, skills non sollicités, flux interrompus). Réglage cible ([[LRN-049]] borner le bruit) = déclencher sur signaux d'intention CLAIRS et non-ambigus ; **ambigu → DEMANDER, pas auto-déclencher**. À définir précisément SI (et seulement si) le RED valide : table `signal → skill` + la frontière exacte de l'ambiguïté.
 
 ## 2026-06-30 — session-close follow-ups (promoted from BLK-013 / BDR-043)
-- [ ] (a) Harden install-plugins.sh Step 1 — guarantee `npm` on apt-`nodejs` hosts (detect missing npm + `corepack enable npm`), not just check `node >=22`. Fix-forward for [[BLK-013]] — stops `make plugin` Error 127 recurring on any fresh apt machine.
+- [x] (a) Harden install-plugins.sh Step 1 — guarantee `npm` on apt-`nodejs` hosts (detect missing npm + `corepack enable npm`), not just check `node >=22`. Fix-forward for [[BLK-013]] — stops `make plugin` Error 127 recurring on any fresh apt machine.
+      [done 2026-07-01 : unconditional npm guard after Node block (corepack enable npm → distro `install npm` fallback → fatal exit 1 w/ clear msg). Catches node>=22-present-but-npm-absent (NODE_OK short-circuit). shellcheck clean, bash -n OK. Fresh-apt live validation pending (no npm-less host to hand). branch bugfix/install-plugins-npm-guard.]
 - [x] (b) Re-baseline darwin on the 5 ex-broken gstack skills (`benchmark-models`, `context-restore`, `context-save`, `make-pdf`, `plan-tune`) — now repaired and back in scope ([[BDR-043]], trigger cleared). Verify `results.tsv` still marks them `status=error` first. (Promoted from BDR-043's action-field — not an item the user authored.)
       [resolved-MOOT 2026-06-30 : won't-run. BDR-043 cleared only motif (a) of BDR-015's TWO exclusion grounds (symlinks repaired ✅); motif (b) external-ownership INTACT — the 5 resolve to skills-external/gstack/ (submodule), darwin optimizes by EDITING SKILL.md → would dirty the submodule (forbidden [[LRN-070]]). Re-baseline = unactionable score. + results.tsv gone (wiped by 23/06 make-plugin reinstall) → not even a re-baseline, a fresh-from-zero one. Geometric trigger lifted, value trigger intact — twin of --help [[LRN-080]]. See [[LRN-082]]. Not "done", not "open": MOOT.]

install-plugins.sh

@@ -162,6 +162,32 @@ if [ "$NODE_OK" = false ]; then
   fi
 fi
 
+# --- npm (bundled with Node, but distro `apt install nodejs` can ship it separately) ---
+# BLK-013 fix-forward: node>=22 present does NOT imply npm present. GSD (gsd-pi)
+# and ctx7 install via `npm install -g`, so a missing npm makes `make plugin`
+# die with Error 127 mid-run. The Node block above short-circuits when node is
+# already recent (NODE_OK=true) and never checks npm, so guarantee it here.
+if ! command -v npm &>/dev/null; then
+  info "npm missing (Node without npm) — enabling via corepack, else package manager..."
+  if command -v corepack &>/dev/null; then
+    sudo corepack enable npm 2>/dev/null || corepack enable npm 2>/dev/null || true
+  fi
+  if ! command -v npm &>/dev/null; then
+    case $OS in
+      linux-apt)    sudo apt-get install -y npm || true ;;
+      linux-dnf)    sudo dnf install -y npm || true ;;
+      linux-pacman) sudo pacman -S --noconfirm npm || true ;;
+      macos)        brew install node || true ;;   # brew's node bundles npm
+      *) : ;;
+    esac
+  fi
+  if command -v npm &>/dev/null; then
+    ok "npm $(npm --version)"
+  else
+    err "npm still missing — GSD/ctx7 need it; install npm manually then re-run"; exit 1
+  fi
+fi
+
 # --- Rust + Cargo (for RTK) ---
 if command -v cargo &>/dev/null; then
   ok "Rust/Cargo $(cargo --version | awk '{print $2}')"