fix: keep ClawHub publish dry-run preflight

Preserve the ClawHub CLI dry-run preflight while making the printed publish preview include CLAWHUB_WORKDIR. Add regression coverage that stubs the ClawHub CLI and verifies --dry-run is forwarded through the publish script.

scripts/plugin-clawhub-publish.sh

@@ -76,7 +76,7 @@ echo "Resolved source ref: ${source_ref:-<missing>}"
 echo "Resolved ClawHub workdir: ${clawhub_workdir}"
 echo "Publish auth: GitHub Actions OIDC via ClawHub short-lived token"
 
-printf 'Publish command:'
+printf 'Publish command: CLAWHUB_WORKDIR=%q' "${clawhub_workdir}"
 printf ' %q' "${publish_cmd[@]}"
 printf '\n'
 

test/plugin-clawhub-release.test.ts

@@ -1,6 +1,6 @@
 import { execFileSync } from "node:child_process";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { delimiter, join } from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
 import {
   collectClawHubPublishablePluginPackages,
@@ -362,6 +362,41 @@ describe("collectPluginClawHubReleasePlan", () => {
   });
 });
 
+describe("plugin-clawhub-publish.sh", () => {
+  it("previews the publish command through the ClawHub CLI dry-run preflight", () => {
+    const repoDir = createTempPluginRepo();
+    const binDir = join(repoDir, "bin");
+    const markerPath = join(repoDir, "clawhub-invoked");
+    mkdirSync(binDir, { recursive: true });
+    const clawhubPath = join(binDir, "clawhub");
+    writeFileSync(
+      clawhubPath,
+      `#!/usr/bin/env bash\nprintf '%s\\n' "$@" > ${JSON.stringify(markerPath)}\nexit 0\n`,
+    );
+    chmodSync(clawhubPath, 0o755);
+
+    const output = execFileSync(
+      "bash",
+      [
+        join(process.cwd(), "scripts/plugin-clawhub-publish.sh"),
+        "--dry-run",
+        "extensions/demo-plugin",
+      ],
+      {
+        cwd: repoDir,
+        encoding: "utf8",
+        env: {
+          ...process.env,
+          PATH: `${binDir}${delimiter}${process.env.PATH ?? ""}`,
+        },
+      },
+    );
+
+    expect(output).toContain("Publish command: CLAWHUB_WORKDIR=");
+    expect(readFileSync(markerPath, "utf8")).toContain("--dry-run");
+  });
+});
+
 describe("collectPluginClawHubReleasePathsFromGitRange", () => {
   it("rejects unsafe git refs", () => {
     const repoDir = createTempPluginRepo();