chore: update PR 332 tooling for capability model

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,7 +2,7 @@
 Thanks for the PR! A few quick reminders before you hit submit:
 - DCO sign-off on every commit (git commit -s; --amend -s to fix)
 - Plugin work? Check docs/PLUGIN_AUTHORING.md and validate plugin.json
-  against schema/plugin.schema.json
+  against schema/plugin.schema.json, including capability metadata
 - Touching the highway / player UI? Add or update a Playwright test
   under tests/browser/
 -->
@@ -23,7 +23,7 @@ Thanks for the PR! A few quick reminders before you hit submit:
 - [ ] `npm run test:js` passes locally
 - [ ] `npm test` (Playwright) passes locally — *or* CI will run it
 - [ ] Verified in `docker compose up` (live-reload working directory)
-- [ ] Plugin manifest validates against `schema/plugin.schema.json`
+- [ ] Plugin manifest validates against `schema/plugin.schema.json` (legacy fields + capability metadata)
 - [ ] Not applicable — explain below
 
 ## Screenshots / recordings

.github/copilot-instructions.md

@@ -14,8 +14,9 @@ This file customizes GitHub Copilot Chat and Copilot inline suggestions for the
 - **No frontend frameworks.** Vanilla JS, Canvas, Tailwind classes. Do not suggest React/Vue/Svelte additions.
 - **Plugin backend logging.** Suggest `context["log"]`, never `print()`.
 - **Plugin Python imports.** For cross-file backend plugins, suggest `context["load_sibling"]("module_name")` instead of bare `from module_name import X`.
+- **Capability metadata.** For new plugin integrations, suggest `standards: ["capability-pipelines.v1"]` and redaction-safe `capabilities` / `ui` metadata instead of legacy globals alone.
 - **DCO/license headers.** When creating a new file in the main repo, no license header is needed (the LICENSE file at root governs). Plugin authors should add an SPDX-License-Identifier comment to their plugin's source files; the `license` field in `plugin.json` must match the allowlist in [`CONTRIBUTING.md`](../CONTRIBUTING.md).
 
 ## Validation
 
-When suggesting changes to a `plugin.json`, validate against [`schema/plugin.schema.json`](../schema/plugin.schema.json).
+When suggesting changes to a `plugin.json`, validate against [`schema/plugin.schema.json`](../schema/plugin.schema.json). The schema accepts current legacy fields and native `capability-pipelines.v1` metadata.

.github/workflows/validate-plugins.yml

@@ -34,7 +34,7 @@ jobs:
           python -m pip install --upgrade pip
           pip install -r requirements-test.txt
 
-      - name: Validate every in-tree plugin.json against schema
+      - name: Validate every in-tree plugin.json against capability-aware schema
         run: |
           python - <<'PY'
           import glob, json, sys
@@ -66,7 +66,7 @@ jobs:
               sys.exit(1)
           PY
 
-      - name: Run schema sanity tests
+      - name: Run schema and capability contract tests
         # --noconftest skips tests/conftest.py, which imports structlog
         # (not in requirements-test.txt). The schema tests don't use
         # shared fixtures, so this is safe and avoids dragging the full