feat: add mmd-it marketplace + mmd-workspace plugin (4 MMD skills)

Org-wide Claude Desktop plugin marketplace for MMD Group IT. Adds the
mmd-it marketplace manifest and the mmd-workspace plugin
(installationPreference: required) carrying four skills grounded in
real MMD material: mmd-document-style, mmd-email-style,
mmd-it-support, mmd-data-handling. Public repo, no secrets — MCP
credentials are delivered separately via managedMcpServers.

plugins/mmd-workspace/skills/mmd-it-support/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: mmd-it-support
+description: Use when an MMD staff member needs to raise, track, or ask about an IT request — a new PC, a broken tool, a licence, remote help, or "who do I ask about X". Triggers on "IT ticket", "raise a request", "MMD Support", "helpdesk", "is this broken for everyone", "how do I get help with", or "what will IT do remotely".
+---
+
+# Getting help from MMD IT
+
+MMD's IT ticket system of record is **MMD Support** (GLPI, `support.baobab-ts.com`). It is not
+a chat channel or an ad-hoc email address — every real IT request should end up there as a
+ticket, because that is the only place status, history, and follow-up are tracked.
+
+## How to raise a request
+
+Two ways in, both land in the same system:
+
+1. **Email `helpdesk@Fabrimetal.net`.** An inbound mail bridge polls that inbox and turns the
+   message into a ticket automatically, tagging it with a `[MMD #<number>]` reference. Anyone
+   replying on the thread afterwards should keep that marker in the body (see the
+   `mmd-email-style` skill) so replies land on the same ticket instead of opening a new one.
+2. **Go to `support.baobab-ts.com` directly** and sign in with your normal MMD account (Entra
+   single sign-on) to open a ticket, or to check status on one already open.
+
+Either way produces the same ticket, visible to IT, with the same tracking.
+
+## What to expect back
+
+- A ticket gets picked up, worked, and updated on the same thread/record — not answered once
+  and dropped.
+- For something IT needs to fix on your machine or account remotely, the tool is
+  **MeshCentral** (`mesh.baobab-ts.com`) — remote control of an enrolled device, always
+  launched *from* a ticket rather than as a cold connection. If someone claiming to be IT asks
+  to remote into your machine outside of an open ticket, that is worth double-checking.
+- Device-level changes (enrolling a new PC, wiping/resetting one, pushing configuration) go
+  through **Intune**, MMD's device-management platform — not through hand-editing a machine
+  locally. That is a deliberate control, not a workaround to route around.
+- Identity and licence changes (new accounts, licence assignment, access to a system) go
+  through MMD's account-provisioning process, tied to Entra ID — not a manual one-off grant.
+
+## What IT will and won't typically do remotely
+
+- Will: diagnose and fix software/account issues through a ticket, using MeshCentral for
+  hands-on remote control of an enrolled, managed device.
+- Will: push configuration and app changes through Intune to enrolled devices.
+- Won't: make changes to an unmanaged/unenrolled personal device the same way a managed
+  corporate device gets handled — enrollment is what makes MeshCentral/Intune apply at all.
+- Won't: action account, licence, or device changes from an unverified request outside the
+  ticket system — that is what the ticket record and sign-in are for.
+
+## If something in the IT tool catalog looks broken
+
+MMD IT tracks the real, currently-verified status of every tool it runs (not just whether a
+URL returns 200) — sign-in pages, dashboards, and known-broken tools are all recorded plainly
+rather than hidden. If a link in the portal's IT section is dead or a tool errors out, that is
+worth a ticket in its own right (with the exact URL and what happened) rather than assuming
+it's a one-off.
+
+## What NOT to do
+
+- Don't email a random personal inbox or chat message about an IT problem and expect it to be
+  tracked — if it didn't become a ticket, it isn't tracked.
+- Don't ask for remote access to be granted outside of a ticket.
+- Don't try to self-serve a device wipe/re-enrollment by hand; that is Intune's job and doing
+  it manually breaks the record IT relies on.