BUG-121: claude-plugins reports success after its installs fail #2336

Observed (X1 run 38110204139, #2013)

Ubuntu, legacy-setup:

• dotf deploy logged Error: claude-plugins: 3 plugin(s) failed to install: gopls-lsp@…, security-guidance@…, frontend-design@… plus three failed claude-plugins … did not install rows.
• Then setup-linux.sh printed [WARNING] dotf deploy failed -- run it again after setup and, 40 lines later, [SUCCESS] Claude Code plugins ready (0 added, 0 already present).
• The first converge still reported result: ok with no failed entry.

macOS, configs-deploy: installed claude-plugins 0 added, 0 already present, with three plugins declared in ai/claude/plugins.json. Zero added, zero failed and zero present cannot all hold for three declared plugins.

Causes (from the code)

1. setup-linux.sh:935-965 is a shell twin of deployClaudePlugins (cli/internal/cmd/deploy_claude.go). It counts only successful installs, discards each failure (>/dev/null 2>&1, no else branch), and logs success unconditionally.
2. A failing dotf deploy inside setup-linux.sh becomes a WARNING, so converge's legacy-setup entry reports ok (the lesson 328 class: a step that warned and went on).
3. The macOS 0/0/0 is unexplained. Either the syncer saw an empty list, or it counted nothing it did. To measure.

Fix shape

• Delete the shell block. dotf deploy already runs the Go step; per the agnostic-CLI rule, no shim replaces it.
• Make the macOS counts add up to the declared list, or fail naming why.
• A guard: deployClaudePlugins cannot report installed unless added + present + failed equals the declared count.
• Find out why the installs fail on a fresh runner (no Claude login? marketplace not registered?) and report that as the cause.

Found by the from-zero job (#2331); ledger row on #2013.