32 workflow runs on a repo of static JSON and markdown, and three stale
Dependabot PRs, for a package that changes maybe monthly.

Removed outright:

- .github/workflows/hol-plugin-scanner.yml — a third-party security scanner
  running against a package whose own SECURITY.md correctly states it contains
  no executable code and no secrets. It scanned static JSON and markdown 15
  times and could never have found anything.
- .github/dependabot.yml — it existed only to bump the actions consumed by our
  own workflows. Every PR it opened (#1-#3, now closed) was maintenance
  generated by the maintenance. Deleting the scanner removes a third of its
  surface anyway.
- The weekly cron I added, which would have kept firing on an untouched repo
  until it eventually broke on an upstream move and mailed about it.
- The `push` trigger. Every change here lands through a PR, so push + PR ran
  the identical checks twice per change.

Kept one job, on pull_request only, because the failure mode this guards is
silent: under Agent Plugins §7.1 a client MUST *skip* a non-conforming skill.
Nothing errors and nothing warns — the plugin quietly does less. That is not
hypothetical; 12 of 13 skills were being dropped that way before it was caught.

Dropped the two `npx ajv-cli` steps and folded their coverage into
check_conformance.py, which already enforced the closed field set, the $schema
constant, the name constraints and the mcp.json rules. It now also checks
manifest field types and the closed author sub-object, so it is a complete
substitute for plugin.schema.json rather than a partial one. Verified by a
negative test: a manifest with `keywords` as a string and a stray `author.twitter`
is rejected with both violations named. ajv remains documented in README,
SECURITY and CONTRIBUTING as the canonical check for anyone auditing by hand.

Net: 2 workflows + cron + Dependabot + 4 network installs per change
-> 1 workflow, PR only, one pip install and one stdlib script.

Verified: check_conformance.py 12/12 (was 11 — added the field-type check);
ajv still agrees with it on both manifests; skills-ref 1/1; docs no longer
describe triggers that no longer exist.

Co-Authored-By: CRHQ <noreply@crhq.ai>