* test(#3751): the validation fixture must cover agents/ and CI must provision the CLI
* fix(#3751): cover agents/ in the plugin-validate fixture and provision the claude CLI in CI
* fix(#3751): wire the strict live-config guard into the plugin-validate job
* fix(#3751): job-level strict-guard env, where the guard derivation reads it
* chore(#3751): changeset for the CI-provisioned plugin-validate gate
* chore(#3751): backfill changeset pr number
---------
Co-authored-by: sim <sim@local>
