fix(version): scope git add to files stamp-version.js writes (#339)

Replaces 'git add -A' in the npm version lifecycle script with an
explicit allowlist:
- package.json
- package-lock.json (npm version writes this)
- .claude-plugin/plugin.json
- .claude-plugin/marketplace.json
- site/content.json

Original PR #339 from xiaolai (NLPM audit) flagged that 'git add -A'
sweeps any unrelated working-tree changes into the version commit.
This is the broadened-allowlist version per Copilot's review suggestion -
preserves the intent (no working-tree sweep) while keeping all version
manifests in sync.

Co-authored-by: Avi Fenesh <aviarchi1994@gmail.com>
Co-authored-by: xiaolai <xiaolai@users.noreply.github.com>

Author: xiaolai

package.json

@@ -37,7 +37,7 @@
     "bump": "node bin/dev-cli.js bump",
     "detect": "node bin/dev-cli.js detect",
     "verify": "node bin/dev-cli.js verify",
-    "version": "node scripts/stamp-version.js && git add -A",
+    "version": "node scripts/stamp-version.js && git add package.json package-lock.json .claude-plugin/plugin.json .claude-plugin/marketplace.json site/content.json",
     "setup-hooks": "node bin/dev-cli.js setup-hooks"
   },
   "repository": {