fix(vetted-ops): resolve standalone so the plugin copy runs

[potiuk]

Summary

• The magpie-vetted-ops plugin cannot run from where it is installed. Every documented invocation — the README's sandbox.excludedCommands / allow entries, isolated-setup-install, and the skills' uv run --project <framework>/tools/vetted-ops vetted-op-read … recipes — fails on a marketplace install with magpie-dev was not found in the package registry … vetted-ops:dev's requirements are unsatisfiable.
• Cause: the plugin symlinks tools/vetted-ops, whose pyproject.toml declares [dependency-groups] dev = ["magpie-dev"]. magpie-dev only resolves through the workspace root's [tool.uv.sources], which the plugin does not ship, and uv resolves every group before running anything (--no-dev does not help).
• Fix: drop the dev group from tools/vetted-ops (with a comment saying why), and add a regression test that the project declares nothing workspace-only. The toolchain still reaches its tests: CI's uv sync --all-packages --group dev and the workspace checks both use the root dev group, which names magpie-dev. tools/dev/README.md records the exception to the "every member names magpie-dev" convention.

Type of change

• Python package (tools/*/ with pyproject.toml)
• Documentation (docs/, README.md, CONTRIBUTING.md)

Test plan

• Reproduced on the installed plugin (0.2.0.dev202609222337): uv run --project ~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/<ver>/tools/vetted-ops vetted-op-read … → unsatisfiable magpie-dev; same with --no-dev.
• Standalone copy of the fixed tools/vetted-ops (outside the workspace, as the plugin ships it): uv run --project <copy> vetted-op-read --caller x list-ops resolves and runs.
• CI shape: uv sync --all-packages --group dev then uv run --directory tools/vetted-ops pytest → 146 passed (incl. the new test).
• New test_project_resolves_outside_the_workspace fails against the unfixed pyproject.toml and passes with the fix.
• uv lock refreshed (drops the vetted-ops dev-group entries).
• prek run --files on the changed files passes. One earlier run reported pytest failed for: agent-isolation; it did not reproduce on re-run, and that suite passes on its own (256 passed) — looks unrelated and flaky.

Linked issues

Refs #1310 (added the uv run --project exclusion this invocation is meant to hit).

Notes for reviewers (optional)

Alternative considered: keep the dev group and switch every documented invocation to uvx --from <plugin>/tools/vetted-ops vetted-op-read … (a wheel build ignores dependency groups — verified working). Rejected as the larger change: ~20 call sites across skills, docs, .claude/settings.json and sandbox-lint/expected.json, and a second excludedCommands shape to keep in sync. Adopters who already added a uvx --from exclusion as a workaround can drop it after upgrading.

🤖 Generated with Claude Code