feat: add ultraswarm orchestration plugin

[fubak]

What this PR does

• New third-party plugin: ultraswarm
• Type: remote source
• Source URL + pinned SHA: https://github.com/fubak/ultraswarm.git @ 4a8a22a1e653cad2c18cb664c0cfecce5c506d4f
• Homepage: https://github.com/fubak/ultraswarm

Ultraswarm is a durable multi-CLI coding orchestrator supporting Codex, Claude Code, Grok, Cursor Agent, local/private models (via pi), and shell workers. It owns:

• Complexity + effort-aware task decomposition
• Capability and repo-metric based worker routing with explanations
• Isolated git worktree execution + supervision + timeouts + cancellation
• Explicit plan / merge approvals, transactional integration, recovery, exportable provenance

The plugin surfaces a ultraswarm skill (with /ultraswarm or ultraswarm invocation) that delegates planning/execution to the user's installed standalone runner (bin/ultraswarm.mjs).

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (or I've explained why not below).

Sourced from personal account fubak/ultraswarm (the project brand/username). Similar to other entries (e.g. superpowers from obra).

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json.
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set.
• License is stated (MIT in plugin manifest).

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars (the skill is instructional).
• Hooks and MCP scope: none shipped by this plugin.
• Network endpoints this plugin calls (and why): None from the skill/plugin itself. The delegated runner invokes user-chosen AI CLIs (which may make their own API calls using the user's keys).
• Credentials/permissions it requires (and why): The user must have the worker CLIs authenticated in their environment (as documented). The plugin skill itself requires no additional credentials.

The skill instructs the host to locate and invoke the separately cloned ~/projects/ultraswarm (or ULTRASWARM_HOME) runner. All privileged operations (process spawning, git worktrees, writes) happen in that runner under user control.

Notes for reviewers

• The root of the ultraswarm repo contains:
  • skills/ultraswarm/SKILL.md (with frontmatter)
  • .grok-plugin/plugin.json and .claude-plugin/plugin.json (for compatibility)
• The skill is deliberately thin: "use the standalone runner, do not reimplement orchestration here."
• This enables Grok Build users to orchestrate ambitious multi-model/agent workflows directly from the chat with proper gates and provenance.
• Related project README has install instructions for multiple hosts.

[fubak]

Companion PR in source repo: fubak/ultraswarm#31 (lands .grok-plugin/ + docs + hygiene to main). All local validates + full test suite (321 tests) pass on the branch. Ready for review/merge.

[fubak]

Final update (post all work):

• Pinned to 877bf956682132388f17e55cd8d14e45c1cafc8d (tip of hygiene branch based on merged Add observational-memory plugin #31).
• Includes:
  • Full .grok-plugin/ + .claude-plugin/ manifests
  • README maintenance guide + deduplication
  • .gitignore cleanup
  • scripts/validate.sh now validates the Grok manifest and enforces the two manifests are identical (Codex review feedback implemented)
• Regenerated + validated index.
• Ultraswarm source PR merged; full test suite + validate.sh green.
• All checks (catalog + generate --check) passing.

This is the complete submission. Please review and merge when ready.