references/*.md templates missing from every installed plugin (only exist at repo root) #119

Summary

Every plugin's CLAUDE.md template (and each cold-start-interview) tells Claude to load references/dashboard-template.md and references/company-profile-template.md "in the plugin root". Those files only exist at the repo root (/references/). The marketplace installs each plugin from its own subdirectory ("source": "./employment-legal" etc.), so the files are never present in an installed plugin.

Repro

1. Install any plugin from this marketplace (e.g. employment-legal).
2. Look in the installed plugin directory: there is no references/ folder.
3. Run /employment-legal:cold-start-interview on a machine with no company-profile.md. The skill says to write the shared profile "per the template at references/company-profile-template.md in the plugin root" (employment-legal/skills/cold-start-interview/SKILL.md:44). The file is not there, so the model improvises the shared profile schema, and each plugin that is set up first may write a different shape.
4. Same for the dashboard offer: employment-legal/CLAUDE.md:127 and :131 say the dashboard format is standardized in references/dashboard-template.md, including the HTML-escaping rule for untrusted input. The model cannot read it, so the "standardized" dashboard and its escaping rule are improvised.

Affected: all 12 plugins (grep -rl "references/dashboard-template.md" hits 2 files in each of ai-governance, commercial, corporate, employment, ip, law-student, legal-builder-hub, legal-clinic, litigation, privacy, product, regulatory).

Confirmed on an installed copy: synced corporate-legal has no references/ dir; only legal-builder-hub and privacy-legal ship their own (different) references/.

Why it matters

The company profile is the one file shared by all plugins; a missing template means schema drift between plugins. The dashboard template carries a security rule (HTML-escape untrusted cells, textContent not innerHTML, URL scheme check) that silently does not load.

Proposed fix

• Cheap: copy references/dashboard-template.md and references/company-profile-template.md into each plugin's own references/ (a build step or a CI check that they stay in sync).
• Bigger: inline the company-profile schema directly in each cold-start-interview SKILL.md, and inline the escaping rules in the CLAUDE.md template so the security guidance does not depend on a file read.