Tests check the manifests' wiring, and CI runs weekly

[parintorns]

What changes

claude plugin validate --strict (the validate CI job) passes two broken states: a monitors/monitors.json that is not JSON, and a hook in hooks/hooks.json that runs a subcommand scripts/mailbox.py does not have. Both were reproduced on a copy of the repository (validate exited 0 for the marketplace and for plugin.json).

• tests/test_manifests.py (stdlib only, runs in the existing test jobs):
  • every tracked *.json manifest parses (at least four are found);
  • each command in hooks/hooks.json and monitors/monitors.json runs a script under ${CLAUDE_PLUGIN_ROOT} that exists, with a subcommand that mailbox.py's main() dispatches on (command == "...").
• CI also runs every Monday at 03:00 UTC, because the validate job installs the latest Claude Code, whose checks can tighten with no commit here.
• CONTRIBUTING describes the new test.

No change to the plugin's behaviour.

Checks

• python3 -m unittest discover -s tests: 20 OK locally (macOS).
• On the broken copy, the new tests fail on both cases: the unparseable monitors.json and the hook running nosuch.
• claude plugin validate --strict .: passed.

🤖 Generated with Claude Code

[endgame-code-triage]

Reviewed at f22a470. I read the full files: tests/test_manifests.py, .github/workflows/ci.yml, CONTRIBUTING.md, scripts/mailbox.py, hooks/hooks.json, monitors/monitors.json, .gitignore.

I traced the CALL regex against every command string in both manifests — it correctly captures scripts/mailbox.py and each subcommand. I verified the command == "([\w-]+)" regex extracts all 9 dispatched commands from mailbox.py's main(), and every hook/monitor subcommand (session-start, session-end, prompt, tool-done, waiting, stop, watch) is present in that set. I confirmed the recursive commands() walker correctly traverses both manifest structures. The rglob("*.json") + assertGreaterEqual(len(found), 4) check matches the repo's 4 tracked JSON files. The CI schedule cron is valid and the CONTRIBUTING.md addition is accurate.

Confidence: 85/100 — all code paths verified against actual file contents; the test logic is sound and the CI change is straightforward.

There are no review comments to provide on this diff.