Use versioned PyPI endpoint for pinned packages

[yourconscience]

Problem

Two classes of local-install rot surfaced by dotagents status/doctor:

1. doctor package-age check timed out: for pinned references like ruff==0.15.12 it fetched https://pypi.org/pypi/<pkg>/json, whose full release index is tens of MB for large packages and exceeds the 15s HTTP timeout on slower connections.
2. Plugin version bumps left stale artifacts everywhere: links into superseded codex plugin cache version dirs were classified external and never cleaned (orphan browser link in codex/droid/pi roots, 12 dead links in ~/.claude/skills); hermes external_dirs accumulated 8 dead version-pinned entries; and under delivery: plugin Claude Code stopped receiving codex-plugin skills entirely (the native plugin only ships repo skills).

Fixes

• resolvePyPIRelease: pinned versions resolve via the per-version endpoint (/pypi/<pkg>/<version>/json, ~41KB for ruff); latest keeps the full-index path.
• New pluginSourceRootsForAgent provides version-agnostic plugin source roots so links into superseded version dirs classify as stale-managed and get pruned/updated.
• inspectPluginDeliveryAgent now manages codex-plugin skill symlinks for Claude Code (add/update/remove) while still pruning repo-skill links that the native plugin replaces.
• patchHermesConfig prunes external_dirs entries under plugin source roots (and the legacy ~/.agents/plugin-roots) that aren't current targets; hermes inspection reports them as drift so sync repairs the config.

Verification

• New tests: superseded-version link cleanup, Claude plugin-delivery skill management, hermes stale-dir pruning. Full suite passes.
• Locally: dotagents sync healed all five agents (claude relink 10 + remove 1, codex/droid/pi remove 1 orphan each, hermes prune 8 dead dirs); zero broken managed symlinks remain; doctor 16/16, dogfood clean.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces a new function resolvePyPIVersionedRelease to fetch release information for a specific PyPI package version using the per-version JSON endpoint. This optimization avoids fetching the full release index, which can cause HTTP timeouts for large packages. The resolvePyPIRelease function has been updated to route requests to this new versioned resolver when a specific version is requested. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.