fix: doc-conformant marketplace source, cldk pin, demo fallback

.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   "plugins": [
     {
       "name": "cocoa",
-      "source": ".",
+      "source": "./",
       "description": "Precise static system graphs and provenance-tagged blast radius for polyglot codebases."
     }
   ]

commands/demo.md

@@ -4,7 +4,7 @@ description: Run the Online Boutique flagship demo — map a real 11-service pol
 
 Run COCOA's flagship demo end-to-end.
 
-1. Run `cocoa demo` (first run clones the pinned Online Boutique fixture and may
+1. Run `cocoa demo` (if the `cocoa` CLI is unavailable, use `uvx --from git+https://github.com/codellm-devkit/cocoa cocoa demo`) (first run clones the pinned Online Boutique fixture and may
    take minutes; Java analysis downloads a JDK on first use).
 2. Report the results per cocoa:grounding-claims: graph size, every skipped service
    with reason (a C# skip is expected until codeanalyzer-dotnet ships; a Go skip means

pyproject.toml

@@ -8,7 +8,8 @@ license = { text = "MIT" }
 authors = [{ name = "Rahul Krishna", email = "i.m.ralk@gmail.com" }]
 keywords = ["static-analysis", "mcp", "code-analysis", "call-graph", "cldk"]
 dependencies = [
-    "cldk>=1.4.0,<2",
+    # pinned: the Docker jar workaround (python-sdk#236) hardcodes 1.4.0's layout
+    "cldk==1.4.0",
     "pydantic>=2.10.6,<3",
     "fastmcp>=2.5.1",
     "mcp>=1.9.1",

test/test_plugin_assets.py

@@ -31,7 +31,7 @@ def test_marketplace_manifest_lists_cocoa():
     mp = json.loads((ROOT / ".claude-plugin" / "marketplace.json").read_text())
     assert mp["name"] == "cocoa"
     assert mp["plugins"][0]["name"] == "cocoa"
-    assert mp["plugins"][0]["source"] == "."
+    assert mp["plugins"][0]["source"] == "./"
 
 
 def test_skill_frontmatter_follows_superpowers_conventions():