validate: check SKILL.md frontmatter (name, description, folder match, length)

[deanrie]

Why

Piece 3b of #531: the validator never opens a SKILL.md, so a skill can ship without a name or description, with a name that does not match its folder, or with a description over the 1024-character cap, and CI stays green. The rules come from the skills docs (cursor.com/docs/context/skills, Frontmatter fields): name and description required; name is lowercase letters, digits and hyphens and must match the parent folder.

What

scripts/validate-plugins.mjs now walks each plugin's skills directory (the declared skills path or skills/ by default, non-glob) and, for every <skill>/SKILL.md, parses the frontmatter with a small YAML-subset reader (top-level key: value, quoted scalars, >/| block scalars) and checks:

• Errors (fail the run): no frontmatter block; missing name; missing description.
• Warnings (reported, exit code unchanged, for now): name not kebab-case or not equal to the folder name; description longer than 1024 characters.

Warnings instead of errors for the last two because main currently has five such cases and I did not want this PR to turn CI red or to carry unrelated content edits:

WARN: Plugin "cursor-sdk": skill "cursor-sdk" description is 1045 characters; the limit is 1024
WARN: Plugin "pstack": skill "make-bot-ui" has name "Make Bot UI"; ...
WARN: Plugin "pstack": skill "poteto-mode" has name "Poteto Mode"; ...
WARN: Plugin "x": skill "x-api-mcp-guide" has name "X MCP guide"; ...
WARN: Plugin "x-money": skill "x-money-guide" has name "X Money guide"; ...

#530 fixes the first, #596 the two pstack ones; the two third_party names are for their owners. Once those land, flipping warn( to fail( on the two rules is a two-line follow-up.

Checked

• node scripts/validate-plugins.mjs on current main: 0 errors, the 5 warnings above, exit 0.
• Removing description: from a skill fails with missing "description" in SKILL.md frontmatter; replacing the file with plain markdown fails with has no YAML frontmatter.
• Folded descriptions (description: >- with indented continuation, as in make-bot-ui) parse to a single line and are measured correctly.

Independent of #582 in intent (that one checks declared paths exist); both touch this file, so whichever lands second needs a trivial rebase.

Refs #531.

[deanrie]

Superseded by #618, which carries this commit together with the other two #531 CI pieces as one reviewable PR.