Managed marketplace policy: empty allowlists enforced, settings passed to child processes, clearer errors

What

Managed settings are settings an organization's administrator sets for everyone. Two of them control plugin marketplaces, the catalogs plugins are installed from: blockedMarketplaces blocks marketplace sources, and strictKnownMarketplaces allowlists the sources users can add and install from. This release changes how they are handled:

• Settings validation now reports an error when blockedMarketplaces has entries but none are valid: "Every entry of "blockedMarketplaces" was invalid; none of them can be enforced until it is fixed." Before, only per-entry "Invalid entry was ignored" messages appeared.
• An empty strictKnownMarketplaces array now counts as a restriction in force, as it already did for allowedMcpServers, allowedHttpHookUrls, httpHookAllowedEnvVars and availableModels.
• When managed settings are inherited from a parent process, blockedMarketplaces is now copied through, and strictKnownMarketplaces joins allowedMcpServers and availableModels in being merged in when not already set.
• strictKnownMarketplaces joins allowedMcpServers and availableModels on the list of keys only the admin or policy tier may set.
• The fingerprint used to detect plugin policy changes now tells an unset allowlist or blocklist apart from an empty one, so adding an empty allowlist, which admits no marketplaces, counts as a change.
• Reading a policy settings file now records whether it loaded (loaded, didNotLoad or absent) and whether it holds real policy content, so a file that fails to parse counts as not loaded instead of simply yielding no settings. A helper that copied a fixed set of keys out of the admin settings now returns all of them.

Why

An administrator who sets an empty marketplace allowlist to mean "none allowed" now gets that, including in sessions started by another Claude Code process. A blocklist that is entirely malformed is flagged instead of silently enforcing nothing.