fix: derive marketplace skill count

[sdsrss]

Summary

• derive the marketplace E2E's expected skill count from the release source
  instead of pinning the former 15-skill inventory
• retain an exact source-versus-npm-package equality check, so missing or extra
  packaged skills still fail the release
• add a distribution regression that rejects numeric skill-count literals
• synchronize the corrective release version to 5.1.1

Root cause

The immutable v5.1.0 package correctly contains 17 skills. Its release workflow
reached the post-publish marketplace lifecycle, then failed because
qa/plugin-marketplace-e2e.sh still compared the installed count with the stale
literal 15. The failure was in the release assertion, not plugin installation
or npm packaging.

User and release impact

The marketplace E2E now compares the installed npm plugin with the tagged source
inventory. This corrective patch does not weaken the packaging check and does
not rewrite the already-published v5.1.0 artifacts.

Validation

• RED anchor: distribution 45 passed / 1 failed before the implementation
• targeted: version-sync 6/6, spec-source 7/7, distribution 46/46
• npm run spec:check
• shellcheck -S warning qa/plugin-marketplace-e2e.sh
• bash qa/conformance-eval.sh --validate: 17/17
• npm run check: exit 0, including 383/383 hook smoke cases, Phase 4,
  ShellCheck, and the 24-surface live-home guard
• formal SLO rerun: exit 0, pass:true, inconclusive:false
• version cascade: zero stale README tokens
• outgoing staged secrets scan: evaluated clean
• npm pack --dry-run --json: @sdsrs/agentsmd@5.1.1, 137 entries

The hosted real-model scenarios remain explicitly unverified because
OPENAI_API_KEY is not configured; no workflow or support threshold was
weakened.