Add Expo plugin

[brentvatne]

What this PR does

• Plugin name: expo
• Type: remote source
• Source URL + pinned SHA: https://github.com/expo/skills.git @ d1c68a21ec6a9249cfd2e3885364bb47b243adb2, path plugins/expo
• Homepage: https://docs.expo.dev/agents/

Official Expo plugin for Grok Build: skills for Expo Router, native UI, EAS Build/Submit/Update/Hosting, plus the hosted Expo MCP server at https://mcp.expo.dev/mcp (OAuth).

Ownership

• I own this plugin or have the right to distribute it.
• The source repo is published under our official org (expo/skills).

Checklist

• Added/updated exactly one entry in .grok-plugin/marketplace.json (valid JSON, kebab-case name).
• Remote source pins a full 40-char lowercase commit sha, and that commit is public + reachable.
• Regenerated .grok-plugin/plugin-index.json (python3 scripts/generate-plugin-index.py).
• python3 scripts/validate-catalog.py passes locally.
• python3 scripts/generate-plugin-index.py --check passes locally.
• homepage + clear description set.
• License is stated (MIT, in plugins/expo).

Security

• No curl | bash, remote-code download/exec, or postinstall RCE.
• No reading/exfiltration of secrets, tokens, .env, or env vars.
• Hooks and MCP scope are least-privilege.
• Network endpoints this plugin calls (and why):
  • https://mcp.expo.dev/mcp — hosted Expo MCP (Streamable HTTP, OAuth). Docs, EAS builds/workflows, TestFlight, store reviews.
  • https://api.expo.dev — optional submit-expo-feedback from skills.
  • PostHog — opt-in, off-by-default anonymous skill telemetry (Claude Code hooks only; Grok skips UserPromptExpansion).
• Credentials/permissions it requires (and why):
  • Expo account OAuth (mcp:access) for MCP tools that read/write the user's Expo/EAS projects.
  • Plugin trust for hooks/MCP, same as other marketplace plugins.

Notes for reviewers

Expo already lists this MCP in Claude's connector directory. We verified OAuth + build_list against Grok custom connectors.

Hooks: PostToolUse (matcher Skill) and UserPromptExpansion power optional skill telemetry. Telemetry is off until the user opts in. UserPromptExpansion is not a Grok event and is skipped. CLAUDE_PLUGIN_ROOT is honored via Grok's alias.

The pin is expo/skills main at 1.11.0 (.claude-plugin manifest). A follow-up SHA bump will pick up .grok-plugin/plugin.json once that lands on main.