refresh PR: apm 0.14.0 flag rename + workflow SHA pin

apm 0.14.0 replaced `apm pack --marketplace-output PATH` with the
multi-format `--marketplace FORMAT[,FORMAT...]` plus
`--marketplace-path FORMAT=PATH`. Update the npm script accordingly:

  apm pack --marketplace claude --marketplace-path claude=.github/plugin/marketplace.json

The behavioural contract is unchanged for awesome-copilot (single
Claude Code marketplace.json, same path), but the new surface is
forward-compatible with multi-runtime emission (codex etc) the day
this repo decides to publish for additional assistants.

Also refresh `.github/plugin/marketplace.json` to the apm 0.14.0
emission shape. Two consumer-visible deltas, both Claude Code
marketplace-spec compliant:

- Local entries: `source` field is now emitted as a relative path
  prefixed with `./` (e.g. `./ai-team-orchestration` rather than
  bare `ai-team-orchestration`). This is the pluginRoot-subtraction
  artifact from microsoft/apm#1061; both forms resolve identically
  in Claude Code.
- Local entries: field order is now alphabetised by apm's mapper
  (description, name, version, source) rather than the previous
  generator's emission order. JSON parsers are order-insensitive
  so this has no consumer-visible effect.

External entries (merged in by eng/merge-external-plugins.mjs) are
byte-identical; the bridge controls those.

Workflow pinning: bump validate-marketplace.yml's actions/checkout
and actions/setup-node references to the SHA-pinned v6 entries
already used elsewhere in the repo
(.github/workflows/contributors.yml et al), eliminating the
Node.js 20 deprecation warning that fires on `@v4`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: danielmeppiel