fix(demo): pin origin/main + read INDEX.json for layer resolution — drop the newest-tag resolver, purge retired-layer names

[Justinvolved]

Symptom

The demo consumption contract resolved and checked out the newest git tag of the Distribution, then materialized whatever layer tree that tag carried — including layers removed several releases earlier. A stale or renamed layer name resolved silently instead of failing. (Snapshot materialization of a retired layer is the failure class this closes.)

Change

The clone/checkout flow across the demo skills now:

• Pins the Distribution's latest gate-proven main — git clone once, then git pull --ff-only origin main. Never a tag checkout. Tags demote to provenance/audit history.
• Asserts the layer index's gateProven marker is present (that main is at a gate-proven tip, not mid-release) before consuming.
• Resolves each layer from the index's live entries — a name absent from the live set is looked up under the index's retired tombstones and resolved to its supersededBy successor (loud throw, never silent).
• Records the resolved commit SHA in CUSTOMISATIONS.md as the forensic reproducibility stamp (no re-consumable frozen tag).

Retired layer names are purged from build instructions: the pack-activation worked example + per-pack notes move off the retired reordering-pricing / subscription-orders bundle names onto the live feature-pricing / feature-subscription-orders layers; the header-nav affordance is described as shipping inside theme-default without naming the retired overlay. Retirement notes stay only where they help the reader.

The fold-back content-hygiene gate gains a dead-layer-name sweep (iterate-plugin.md Step 1b §5 + verification gate + anti-patterns): future folds check every Distribution layer name against the index and rewrite a retired name to its successor — kept out of validate-skills.py on purpose so the index stays the single source of truth rather than forking a blocklist that drifts.

Files

dw-demo-base/SKILL.md; dw-demo-base/references/{setup-checks,serializer-reference,iterate-plugin}.md; dw-demo-swift/references/{deserialize-flow,pack-activation,styles-assets,header-menu,integrity-sweep}.md; CHANGELOG.md; .claude-plugin/marketplace.json (4.11.1 → 4.11.2, patch).

Validation

• python scripts/validate-skills.py → exit 0 (0 errors, 0 warnings).
• Sanitization + dead-name grep packs clean over the staged diff (no private repo/engagement tokens, no session-relative time, no retired name left as an instruction).