Release v6.0.3: SDD artifacts move out of the .git/ protected path

Bump all plugin manifests to 6.0.3. This release moves subagent-driven-
development's scratch artifacts (task briefs, implementer reports, review
diffs, progress ledger) from .git/sdd/ — which Claude Code denies agent
writes to — into a self-ignoring working-tree .superpowers/sdd/ dir, and
bumps the brainstorm-server test harness's ws dependency to clear two
dependabot alerts. See RELEASE-NOTES.md.

.agents/plugins/marketplace.json

@@ -1,20 +0,0 @@
-{
-  "name": "superpowers-dev",
-  "interface": {
-    "displayName": "Superpowers Dev"
-  },
-  "plugins": [
-    {
-      "name": "superpowers",
-      "source": {
-        "source": "url",
-        "url": "./"
-      },
-      "policy": {
-        "installation": "AVAILABLE",
-        "authentication": "ON_INSTALL"
-      },
-      "category": "Developer Tools"
-    }
-  ]
-}

hooks/hooks-codex.json

@@ -7,7 +7,6 @@
           {
             "type": "command",
             "command": "\"${PLUGIN_ROOT}/hooks/run-hook.cmd\" session-start-codex",
-            "commandWindows": "& \"${PLUGIN_ROOT}/hooks/run-hook.cmd\" session-start-codex",
             "async": false
           }
         ]

tests/codex/test-marketplace-manifest.sh

@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-MARKETPLACE="$REPO_ROOT/.agents/plugins/marketplace.json"
-
-python3 - "$MARKETPLACE" "$REPO_ROOT" <<'PY'
-import json
-import sys
-from pathlib import Path
-
-marketplace_path = Path(sys.argv[1])
-repo_root = Path(sys.argv[2])
-
-if not marketplace_path.exists():
-    raise AssertionError(".agents/plugins/marketplace.json must exist")
-
-marketplace = json.loads(marketplace_path.read_text(encoding="utf-8"))
-
-def assert_equal(actual, expected, label):
-    if actual != expected:
-        raise AssertionError(f"{label}: expected {expected!r}, got {actual!r}")
-
-assert_equal(marketplace.get("name"), "superpowers-dev", "marketplace name")
-assert_equal(
-    marketplace.get("interface", {}).get("displayName"),
-    "Superpowers Dev",
-    "marketplace display name",
-)
-
-plugins = marketplace.get("plugins")
-if not isinstance(plugins, list):
-    raise AssertionError("plugins must be a list")
-
-matching_plugins = [plugin for plugin in plugins if plugin.get("name") == "superpowers"]
-assert_equal(len(matching_plugins), 1, "superpowers plugin entry count")
-
-plugin = matching_plugins[0]
-assert_equal(plugin.get("source"), {"source": "url", "url": "./"}, "plugin source")
-assert_equal(
-    plugin.get("policy"),
-    {"installation": "AVAILABLE", "authentication": "ON_INSTALL"},
-    "plugin policy",
-)
-assert_equal(plugin.get("category"), "Developer Tools", "plugin category")
-
-plugin_manifest = repo_root / ".codex-plugin" / "plugin.json"
-if not plugin_manifest.exists():
-    raise AssertionError(".codex-plugin/plugin.json must exist")
-
-manifest = json.loads(plugin_manifest.read_text(encoding="utf-8"))
-assert_equal(manifest.get("name"), plugin.get("name"), "plugin manifest name")
-assert_equal(
-    manifest.get("hooks"),
-    "./hooks/hooks-codex.json",
-    "Codex hooks manifest",
-)
-
-print("Codex marketplace manifest looks good")
-PY