fix(plugins): materialize plugins as real files instead of symlinks

.cspell.json

@@ -25,6 +25,7 @@
     "CHANGELOG.md",
     "logs/**",
     ".copilot-tracking/**",
+    "plugins/**",
     "docs/docusaurus/build/**",
     "docs/docusaurus/coverage/**",
     "dependency-pinning-artifacts/**",

.github/codeql/codeql-config.yml

@@ -0,0 +1,10 @@
+# Copyright (c) 2026 Microsoft Corporation. All rights reserved.
+# SPDX-License-Identifier: MIT
+name: "HVE Core CodeQL config"
+
+# The plugins/ tree is auto-generated: every file is a verbatim copy of an
+# already-scanned source under .github/ (agents, prompts, instructions,
+# skills, scripts). Scanning the copies only duplicates alerts, so exclude
+# the generated tree from analysis.
+paths-ignore:
+  - plugins

.github/workflows/codeql-analysis.yml

@@ -39,6 +39,7 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           queries: security-extended,security-and-quality
+          config-file: ./.github/codeql/codeql-config.yml
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0

.github/workflows/pr-validation.yml

@@ -74,7 +74,7 @@ jobs:
           # torch/detoxify stack and runs weekly via weekly-validation.yml,
           # so it is excluded from per-PR Python matrix jobs here.
           $projectList = @(Get-ChildItem -Recurse -Force -Filter pyproject.toml |
-            Where-Object { $_.FullName -notmatch 'node_modules' -and $_.FullName -notmatch 'evals[\\/]+moderation' } |
+            Where-Object { $_.FullName -notmatch 'node_modules' -and $_.FullName -notmatch 'evals[\\/]+moderation' -and $_.FullName -notmatch 'plugins' } |
             ForEach-Object { Resolve-Path -Relative $_.DirectoryName } |
             ForEach-Object { $_ -replace '^\.[\\/]', '' } |
             Sort-Object)

codecov.yml

@@ -46,6 +46,7 @@ coverage:
 ignore:
   - "scripts/tests/**"
   - "logs/**"
+  - "plugins/**"
 
 comment:
   layout: "reach,diff,flags,files"

docs/architecture/ai-artifacts.md

@@ -3,7 +3,7 @@ title: AI Artifacts Architecture
 description: Prompt, agent, and instruction delegation model for Copilot customizations
 sidebar_position: 2
 author: Microsoft
-ms.date: 2026-06-10
+ms.date: 2026-07-10
 ms.topic: concept
 ---
 
@@ -379,7 +379,7 @@ Each collection produces two distributable outputs from the same codebase: a VS
 | Installer        | `ise-hve-essentials.hve-installer`        | HVE Core installation and setup                |
 | Experimental     | `ise-hve-essentials.hve-experimental`     | Early-stage artifacts under active iteration   |
 
-The VS Code extension is built with `Prepare-Extension.ps1` and `Package-Extension.ps1`, parameterized by collection manifest. The Copilot CLI plugin is generated by `npm run plugin:generate`, which creates symlink-based plugin structures under `plugins/{collection-id}/`. Both outputs derive their artifact lists from the same `collections/*.collection.yml` source of truth.
+The VS Code extension is built with `Prepare-Extension.ps1` and `Package-Extension.ps1`, parameterized by collection manifest. The Copilot CLI plugin is generated by `npm run plugin:generate`, which copies each declared artifact into a self-contained plugin package under `plugins/{collection-id}/`. Both outputs derive their artifact lists from the same `collections/*.collection.yml` source of truth.
 
 Users install the collection matching their role for a curated experience. The **Core** extension provides the RPI workflow essentials, while the **Full** extension aggregates artifacts from all stable and preview collections.
 

docs/customization/build-system.md

@@ -2,7 +2,7 @@
 title: Build System and Validation
 description: Understand the plugin generation pipeline, schema validation system, npm scripts, and CI checks for customizing and extending HVE Core
 author: Microsoft
-ms.date: 2026-06-27
+ms.date: 2026-07-10
 ms.topic: how-to
 keywords:
   - build system
@@ -36,6 +36,12 @@ npm run plugin:generate
 > Files under `plugins/` are generated output. Do not edit them directly.
 > Changes made to plugin files are overwritten on the next generation run.
 
+Because every file under `plugins/` is a copy of an already-validated source under
+`.github/`, the generated tree is excluded from source-level checks that would otherwise
+re-scan the copies (spell check, CodeQL, Python project discovery for tests, fuzzing, and
+pip-audit, and code coverage). Validation of the generated output is handled by
+`plugin:validate` and `lint:marketplace` instead.
+
 ## Schema Validation System
 
 YAML frontmatter in markdown files is validated against JSON schemas stored in

package.json

@@ -15,7 +15,7 @@
     "lint:ps": "pwsh -File scripts/linting/Invoke-PSScriptAnalyzer.ps1",
     "lint:yaml": "pwsh -File scripts/linting/Invoke-YamlLint.ps1",
     "lint:json": "pwsh -File scripts/linting/Invoke-JsonLint.ps1",
-    "lint:links": "pwsh -NoProfile -Command \"& scripts/linting/Invoke-LinkLanguageCheck.ps1 -ExcludePaths 'scripts/tests/**'\"",
+    "lint:links": "pwsh -NoProfile -Command \"& scripts/linting/Invoke-LinkLanguageCheck.ps1 -ExcludePaths 'scripts/tests/**','plugins/**'\"",
     "lint:md-links": "pwsh -File scripts/linting/Markdown-Link-Check.ps1",
     "lint:frontmatter": "pwsh -NoProfile -Command \"& './scripts/linting/Validate-MarkdownFrontmatter.ps1' -WarningsAsErrors -EnableSchemaValidation\"",
     "lint:adr-consistency": "pwsh -NoProfile -File scripts/linting/Validate-AdrConsistency.ps1 -Paths docs/planning/adrs",