fix(plugin): bump to 1.2.1 so the head-SHA-gate review-pr.md actually ships; guard the class in CI

[GigaHierz]

Closes #22.

What & why

Two changes, one concern — the plugin version must move when plugin content moves:

1. plugin.json 1.2.0 → 1.2.1. 25fa544 (fix(review-pr): make the head-SHA check a gate that fails, not a note that can be believed #20) changed claude-plugin/commands/review-pr.md — the head-SHA gate — without bumping the version, so every claude plugin update since has compared 1.2.0 to 1.2.0 and kept the old file. The fix for the stale-review class failed to ship through the exact channel built to ship it. Patch bump because fix(review-pr): make the head-SHA check a gate that fails, not a note that can be believed #20 was a fix:.
2. plugin-version-guard.yml — a PR-time check (path-filtered to claude-plugin/**) that fails when plugin content changes without the version line changing. A version-only bump passes; a templates-only PR never runs it.

Verification (both directions, per the CI rule)

The guard's exact check, replayed locally against real history:

• RED — the actual incident: base f7e43be, head 25fa544 → content [claude-plugin/commands/review-pr.md] changed, version stayed 1.2.0 → fails.
• GREEN — this PR: 1.2.0 -> 1.2.1 → passes.

This PR itself exercises the guard live (it touches claude-plugin/ and bumps the version), so its own checks page is the green run; a deliberately-red run can be demonstrated on request by reverting the bump commit on a scratch branch.

What this does NOT do

• No changelog file exists in this repo, so none is updated; if one is wanted, that's its own decision.
• Merging does not update anyone. Each consumer still runs claude plugin update once — that's the ops box on plugin version not bumped with content changes, so claude plugin update no-ops and the head-SHA-gate review-pr.md never ships #22.
• The existing verify-release-version.yml (tag-time, for published packages) is untouched; this guard is PR-time and plugin-specific.