fix(inspect): account composite plugin component emission as host-side dispatch, not intersected claims

[ScriptedAlchemy]

Summary

• The composite plugin target emits commands/ through its Claude side and rules/ through its Cursor side, but inspect's skip accounting consulted the honest three-host capability intersection (fix(cursor): honest workspace/open, real marketplace, three-host composite intersection #221), so the same emitted command/rule was also reported as skipped unsupported-capability — contradictory inspection data.
• Adds a unionCapabilityStates dispatch combinator ("a composite emits a surface if any host side does") and an optional TargetAdapter.componentCapabilities inspection view; the plugin adapter populates it with three-host unions for the component kinds (commands/hooks/mcp/rules/skills). inspect() uses componentCapabilities ?? capabilities for skip accounting.
• Capability CLAIMS are untouched: pluginAdapter.capabilities stays the fix(cursor): honest workspace/open, real marketplace, three-host composite intersection #221 three-host intersection, so capability reports, registry records, and manifest fingerprints are unchanged. Registry validation covers the new field.

Addresses the unresolved P2 Codex finding on #219 (packages/agent-bundle/src/api.ts:463-487).

Test plan

• Integration-config run of api.test.ts, plugin-bundle.test.ts, host-adapters.test.ts (75 tests) plus unit adapter-capability-states.test.ts — the extended fixture asserts the plugin target emits commands/shared.md / rules/shared.mdc AND reports only excluded-by-targets skips; fails without the api.ts change
• Union combinator unit coverage (supported dominates, merged reasons, prohibited∨supported→supported for emission)
• pnpm typecheck / pnpm lint clean

[changeset-bot]

🦋 Changeset detected

Latest commit: b9f02fd

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T23:04:35.876722Z	b9f02fd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.