wfctl plugin verify-capabilities — runtime manifest-vs-plugin.json check

[intel352]

Scope

Deferred from workflow#762 and #764. Now that all 64 plugin repos are wired with sdk.WithBuildVersion (Layer 3b shipped), implement the runtime truth check:

wfctl plugin verify-capabilities [--binary <path>] [--build-tag <tag>] <plugin-dir>

Surface

• New subcommand wfctl plugin verify-capabilities (sibling to validate-contract static check).
• Build from source by default (go build -ldflags="-X .../internal.Version=<--build-tag|v0.0.0-verify>" -o tmp ./cmd/<name>); --binary <path> override skips build.
• Spawn binary as go-plugin subprocess; gRPC-dial; call PluginService.GetManifest.
• Diff strict (set-equality on capability lists; exact on Name/MinEngineVersion; non-empty on Version).
• Exit 0 clean, exit 1 with field-by-field report.

CI integration

Append step to scaffold-template release.yml post-goreleaser, pre-publish:

- name: Verify capabilities (post-build runtime check)
  run: wfctl plugin verify-capabilities --binary dist/<name>_linux_amd64/<name> .

Design + plan tracking

See docs/plans/2026-05-24-verify-capabilities-design.md (committed alongside this issue).

Related

• workflow#762 (parent contract)
• workflow#764 (Layer 3b 71-PR sweep)