plugin:update dropped a go.mod require that was not a strict vX.Y.Z and
treated it as v0.0.0, so a module at a commit after v0.4.0
(v0.4.1-0.<ts>-<hash>) was moved back to v0.4.0. kiosk.Newer now places
a release against a release, a git describe string or a pseudo-version
(by the tag it builds on, in Go's version order); plugin:update and the
admin Plugins screen badge share it. A pseudo-version with no tag before
its commit is left alone with a note naming go get <module>@<tag>.
- TestPluginsEndpoints: 401/403/200 for both endpoints, the update rule
table, cache hit and expiry on an injected clock, failure caching, at
most 4 version lookups at once, call timeout, marketplace validation,
markers, https-only icons, disabled registry making no call
- fix: marketplace categories come only from plugins the screen offers,
not from registry entries dropped for an invalid ID
- check-phase34.sh: TestPluginsEndpoints and useSettings.test.ts required
