fix(plugin): repair validation gates on master

[devin-ai-integration]

Summary

• Repairs three gates left red by the two direct pushes to master, 20175c2e6d and 977b08a14c: Claude native plugin validation, Manifest schema, and the Dashboard lane's check:embedded. It also fixes the clippy::match_bool error introduced in hotspots.rs by those commits.
• Adds a pull_request trigger with the same paths filter to plugin-validation.yml, so plugin breakage is caught before merge instead of after it lands.

Motivation

At 977b08a14c, master fails Manifest schema and Claude native plugin validation in run 37232169975. Every PR branched after that commit also fails the Dashboard lane with embedded/server.mjs is stale, and Clippy because hotspots.rs:73 triggers match_bool on a Boolean flag.

The failures have four causes:

• An unescaped ' appears inside a single-quoted YAML description in investigating-unexpected-changes/SKILL.md.
• The package-manager-cache default in setup-node@v5.0.0 probes for pnpm before pnpm exists.
• The SDK change regenerated operations.ts without rebuilding the committed ChatGPT extension bundle.
• hotspots.rs matches on a Boolean flag.

The plugin-validation workflow ran only after a push, so it did not block these changes before merge.

Changes

• plugin/skills/investigating-unexpected-changes/SKILL.md: changes other agents' work to other agents'' work to escape the YAML single quote.
• .github/workflows/plugin-validation.yml: repins setup-node to the v7.0.0 SHA used by distribution-acceptance.yml and sdk-conformance.yml, sets package-manager-cache: false, and applies the existing paths filter to pull_request.
• plugin/chatgpt-extension/embedded/server.mjs: rebuilds the bundle with pnpm run build for the current SDK surface.
• crates/tracedecay-mcp/src/handlers/analysis/hotspots.rs: replaces the match expression, match churn_available, with if/else to satisfy Clippy, then applies rustfmt.

Test plan

• pnpm run check:embedded in plugin/chatgpt-extension passes (was stale before the rebuild)
• cargo clippy -p tracedecay-mcp --all-targets -- -D warnings clean; the other crates the master pushes touched (runtime-core, contracts, query, graph-query) also clean
• cargo fmt --all -- --check clean
• cargo test -p tracedecay-mcp --lib hotspots passes
• All 17 plugin/skills/*/SKILL.md frontmatter blocks parse as YAML
• Manifest schema + Claude native plugin validation already green on this PR via the new pull_request trigger, the gate proves itself
• Remaining lanes (Linux partitions, feature gates, CLI build), left to CI

Checklist

• CHANGELOG.md updated (not updated; release-please generates it from commits)
• No secrets, credentials, or .env files included
• Breaking changes documented (none)

Link to Devin session: https://app.devin.ai/sessions/2b4ac3c29ab14ef5b7e024585b0f9187
Open in Devin Desktop: https://app.devin.ai/desktop/session/2b4ac3c29ab14ef5b7e024585b0f9187?variant=devin
Requested by: @ScriptedAlchemy

Link to Devin session: https://app.devin.ai/sessions/d1c43c1ea5264a0e9398d1b722b54447
Open in Devin Desktop: https://app.devin.ai/desktop/session/d1c43c1ea5264a0e9398d1b722b54447?variant=devin

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4ad93ca

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)