plugin-creator validator rejects valid hook manifests and optional metadata

Start with codex-rs/skills/src/assets/samples/plugin-creator/scripts/test_validate_plugin.py and the validator it exercises, then compare its behavior with the current Rust ingestion contract and plugin documentation. Run the focused unittest module and quick_validate.py while covering the listed manifest, path, hook, and metadata cases. Done means all 11 tests and git diff --check pass without accessing real plugin state.

Problem

The bundled plugin-creator validator diverges from the current plugin
ingestion contract and official plugin documentation.

It currently:

• requires author and interface, although manifest fields other than
  name, version, and description are optional;
• rejects hooks, although plugin manifests support a path, path array,
  inline hooks object, or array of inline objects;
• validates only the default skills/ location instead of resolving declared
  skill destinations from the plugin root.

As a result, a valid manifest such as the following fails validation:

{
  "name": "synthetic-plugin",
  "version": "1.0.0",
  "description": "Synthetic reproduction.",
  "skills": "./custom/skills/",
  "hooks": "./custom/hooks/hooks.json"
}

Documentation alignment

The expected behavior follows:

• https://developers.openai.com/codex/plugins/build#plugin-structure
• https://developers.openai.com/codex/plugins/build#manifest-fields
• https://developers.openai.com/codex/plugins/build#path-rules
• https://developers.openai.com/codex/plugins/build#bundled-mcp-servers-and-lifecycle-hooks

The current Rust ingestion code also supports the four documented hook forms,
optional interface metadata, declared skill paths, and optional default
discovery.

Proposed correction

• make author and interface optional while retaining their validation when
  present;
• validate all four documented hooks forms without executing handlers;
• resolve declared skill and hook paths relative to the plugin root;
• reject absolute paths, traversal, symlink escapes, missing destinations, and
  invalid hook companions;
• keep absent default skills/ and hooks/hooks.json optional.

Synthetic coverage

A focused unittest module covers:

• the official minimal manifest;
• declared skill destinations;
• all four hook forms;
• optional defaults;
• invalid hook JSON and shapes;
• absolute paths, traversal, and symlink escapes;
• optional rich metadata;
• compatibility with existing scaffold output;
• confinement to synthetic temporary plugin state with network access blocked.

Validation completed successfully:

• python3 -m unittest codex-rs/skills/src/assets/samples/plugin-creator/scripts/test_validate_plugin.py
  — 11 tests passed;
• python3 codex-rs/skills/src/assets/samples/skill-creator/scripts/quick_validate.py codex-rs/skills/src/assets/samples/plugin-creator
  — Skill is valid!;
• git diff --check — passed.

No skill was installed and no personal config, cache, trust, authentication,
marketplace, or real plugin state was read or modified.

A focused implementation is available if the maintainers consider the issue
appropriate and invite a pull request.