docs: update paths in documentation for clarity and consistency

CONTRIBUTING.md

@@ -16,13 +16,13 @@ If you cloned without `--recursive`, run `git submodule update --init --recursiv
 
 ## Repo layout
 
-| Path | What |
-|---|---|
-| `usr/plugins/share_chat/` | The plugin itself (manifests + one HTML extension) |
-| `docs/spec/` | Behaviour contract (BEH-N), implementation plan, e2e spec docs |
-| `tests/component/` | L1 shape suite (testkit assertions, fast, no A0 boot) |
-| `tests/e2e/features/` + `tests/e2e/steps/` | Behaviour-first BDD (Gherkin + Playwright steps) |
-| `tests/_testkit/` | Devkit submodule — runner, gates, shared steps. Do not edit here; PR the devkit repo. |
+| Path                                       | What                                                                                  |
+| ------------------------------------------ | ------------------------------------------------------------------------------------- |
+| repo root                                  | The plugin itself (root layout — manifests + one HTML extension)                      |
+| `docs/spec/`                               | Behaviour contract (BEH-N), implementation plan, e2e spec docs                        |
+| `tests/component/`                         | L1 shape suite (testkit assertions, fast, no A0 boot)                                 |
+| `tests/e2e/features/` + `tests/e2e/steps/` | Behaviour-first BDD (Gherkin + Playwright steps)                                      |
+| `tests/_testkit/`                          | Devkit submodule — runner, gates, shared steps. Do not edit here; PR the devkit repo. |
 
 ## Workflow
 
@@ -48,8 +48,7 @@ If you cloned without `--recursive`, run `git submodule update --init --recursiv
 
 - **No fake green.** Never wrap an assertion in `try/catch` to pass, never add a bare `@skip`
   — skips need a tracked issue link.
-- **Version bumps:** keep `usr/plugins/share_chat/plugin.yaml` and `meta.yaml` versions in
-  sync.
+- **Version bumps:** keep `plugin.yaml` and `meta.yaml` versions in sync.
 - **License:** contributions are accepted under [Apache-2.0](LICENSE).
 - **No secrets** — this plugin has no credentials and it must stay that way. CI and the
   static validator scan for committed secrets.

SECURITY.md

@@ -32,7 +32,7 @@ and copies it to the clipboard. Being honest about the security properties:
 - **Token entropy / guessability of `ctxid`:** Agent Zero chat context ids are short
   (~8 char) random ids generated client- or server-side. They are identifiers, **not**
   secrets — Agent Zero's security boundary is its authentication layer, not ctxid secrecy.
-  Anyone already authenticated to the *same* instance could enumerate or guess chat ids;
+  Anyone already authenticated to the _same_ instance could enumerate or guess chat ids;
   the plugin does not change that pre-existing property.
 - **Exposure surface = your instance's exposure.** If your A0 instance is exposed on a LAN or
   the internet without auth, the link points anyone straight at your conversation. That risk
@@ -51,7 +51,7 @@ and copies it to the clipboard. Being honest about the security properties:
   (prevents accidentally re-sharing tokens that were in your current URL).
 - No-op when no chat is selected (`getContext()` falsy → return).
 - No network calls, no storage, no server-side component — the audit surface is a single
-  ~150-line declarative HTML file: `usr/plugins/share_chat/extensions/webui/chat-top-end/share-chat.html`.
+  ~150-line declarative HTML file: `extensions/webui/chat-top-end/share-chat.html`.
 
 ## Supported versions
 

docs/marketplace-draft.md

@@ -30,7 +30,7 @@ screenshots:
 
 ## Thumbnail
 
-Copy `usr/plugins/share_chat/webui/thumbnail.png` (256×256 square, ~3.3 KB < 20 KB ✓)
+Copy `webui/thumbnail.png` (256×256 square, ~3.3 KB < 20 KB ✓)
 to `plugins/share_chat/thumbnail.png` in the index PR.
 
 ## Pre-submission checklist (flip-time)