fix(video2code): publish dependency cache portably

[Ricardo-M-L]

Plugin type (required) / 插件类型（必填）

• UI Plugin / 是 UI 插件 — provides MCP Apps interactive pages / 提供 MCP Apps 交互页面
• Standard plugin / 普通插件（非 UI） — does not provide MCP Apps interactive pages / 不提供 MCP Apps 交互页面
• Not applicable / 不适用 — repository-only changes; no plugin content changed / 仅仓库级改动，不涉及插件内容

Affected plugin name(s) / 涉及的插件名称：video2code (Standard plugin)

What / 改动内容

The dependency-cache bootstrapper used GNU-only md5sum and mv -T. On a stock macOS/BSD environment, that could fail to publish the cache while the ignored mv error still let --prepare-only print a false success. Concurrent initializations also needed a portable first-writer-wins publication boundary. Separately, the npm install | tail pipeline did not enable pipefail, so a failed delta install could publish a cloned, stale cache that still contained .bin/vite.

This change:

• falls back from GNU md5sum to BSD md5 -q;
• replaces mv -T with an atomic, portable mkdir publication lock and same-filesystem rename;
• considers a cache reusable only when its Vite entrypoint exists;
• fails closed for incomplete entries, publication failures, and lock timeouts;
• enables pipefail around the npm pipeline so failed installs cannot be published;
• adds plugin-local regression tests for BSD-style tools and paths with spaces, two concurrent builders, and a failed delta install;
• updates equivalent English and Chinese documentation and bumps video2code from 0.6.0 to 0.6.1 in both manifests and marketplace.json.

No new dependency, network request, permission, or third-party material is introduced. Existing npm network access and cache writes remain documented.

Open PR #47 changes Python launcher resolution in the same plugin but does not overlap this cache path. It also currently reserves version 0.6.1; whichever PR lands second will need to rebase and use the next free plugin version.

Validation

• python3 -m unittest plugins/video2code/tests/test_node_modules_cache.py -v — 3 passed.
• Full plugin-local suite — 17 passed.
• bash -n plugins/video2code/skills/web-replicate/scripts/relink-node-modules.sh — passed.
• shellcheck — no new warning; only the pre-existing SC2012 informational finding remains.
• pnpm install --frozen-lockfile — passed.
• pnpm build — passed with Node.js 24.20.0.
• pnpm test — passed (31 root TypeScript tests and all UI-plugin suites).
• python3 scripts/validate.py — 34 plugins validated.
• python3 scripts/build_dist.py — 34 artifacts and 292 assets built.
• git diff --check — passed.
• python3 -m unittest discover -s tests — 125 tests run, 19 skipped, with one expected failure in the unchanged maintainer-owned tests/test_video2code_plugin.py: it hard-codes the previously published version 0.6.0. Contribution policy keeps this PR scoped to the plugin and marketplace rather than modifying root tests. PR fix(video2code): resolve Python across platforms #47 documents the same version-fixture mismatch.

The bootstrapper behavior was exercised directly with controlled concurrent subprocesses; a full ZCode desktop session was not available.

Self-check / 自查清单

• Plugin name is unique kebab-case; new external plugin directory is external_plugins/<name>/; existing fixes retain ownership / 插件名唯一且 kebab-case，外部新增插件位于 external_plugins/<name>/，已有插件修复保留原归属
• Usage category is set independently of publisher ownership / 用途分类 category 已填写，与维护归属分开
• Plugin type and affected names are declared above / 已在上方声明插件类型与涉及的插件名称
• version bumped in BOTH plugin.json and marketplace.json (artifacts are immutable) / plugin.json 与 marketplace.json 两处版本号已同步升级（制品不可变）
• README.md (EN) and README_CN.md (中文) both updated and equivalent / 中英文 README 均已更新且语义一致
• description_i18n has both en and zh-CN / description_i18n 包含 en 与 zh-CN
• No secrets, machine-specific paths, or private dependencies / 不含密钥、机器专属路径或私有依赖
• Model/API/network dependencies documented / 模型、API、网络依赖已写明
• python3 scripts/validate.py and python3 scripts/build_dist.py pass locally / 本地校验与构建均通过

[panda920]

✅ Internal validation passed. A ZCode maintainer will review the change next; after acceptance, release checks run separately and this PR is closed automatically.