scaffold hand-writes build-owned root marketplace.json → root-artifact-collision on a fresh workspace-mode repo's first build

[mike-north]

Discovered by #94's implementer while exercising a realistic workspace-mode repro; reproduces on main independently of #94. A fresh workspace-mode repo hitting a root-artifact-collision finding on its FIRST build is a broken golden path — the false-friction class the DX study punishes.

Problem

aipm scaffold (runScaffold) hand-writes the repo-root Open Plugins marketplace.json, but aipm build (runBuild) also owns and generates that root artifact. On a workspace-mode repo's first build after a fresh scaffold, the scaffold-written marketplace.json collides with build's generated version, producing a hard root-artifact-collision finding — so a brand-new scaffolded repo fails its own first build with no user error.

This is a single-writer violation: two commands write the same generated artifact. build should be the sole writer of anything it generates; scaffold should not pre-materialize an artifact that build owns.

Repro (from #94's implementer)

# fresh workspace-mode repo
npx aipm scaffold <plugin>        # runScaffold hand-writes repo-root marketplace.json
npx aipm build                    # runBuild regenerates it → root-artifact-collision (hard finding) on FIRST build

Reproduces identically on main before #94's change; orthogonal to #94 (which only removed vercel from the default target set).

Governing references

• GeneratedFile.target shared-artifact ownership model, shipped in Model shared-artifact ownership in GeneratedFile.target #54 (commit 600e3a0, "Model shared-artifact ownership in GeneratedFile.target") — the fix should ALIGN with this ownership modeling: the root marketplace.json is a build-owned generated artifact, so scaffold must not write it.
• packages/core/src/pipeline/scaffold.ts (runScaffold — the hand-write) and packages/core/src/pipeline/build.ts (runBuild — the generator/owner).
• The root-artifact-collision finding (the symptom) in the validation/build pipeline.

Acceptance criteria

1. scaffold does NOT hand-write any artifact that build owns/generates (single-writer principle): the repo-root Open Plugins marketplace.json is written only by build.
2. A fresh workspace-mode scaffold followed by a first build is finding-free — no root-artifact-collision (nor any other spurious finding) on the golden path.
3. A regression test at the scaffold → build integration layer constructs a fresh workspace-mode repo, runs scaffold then build, and asserts the first build is finding-free (and that marketplace.json is present + correct, written by build).

Non-goals

• No change to the root-artifact-collision finding's own logic — the finding is correct; the fix is removing the duplicate writer so it never legitimately fires on the golden path.
• No broader scaffold/build refactor beyond making build the sole writer of its owned root artifacts.

Proof

The integration test (fresh workspace-mode scaffold → build) is finding-free and fails against current main (where the collision fires); marketplace.json exists post-build, authored solely by build.

Priority

Normal.