test(openclaw): plugin-loader compat fixture + e2e test

[plind-junior]

What you're trying to do

gbrain has test/e2e/openclaw-plugin-load-real.test.ts that exercises a real OpenClaw plugin loader against a fixture deployment. Vouch ships openclaw.plugin.json but has no test that the manifest actually loads. A drift between vouch's manifest and OpenClaw's evolving plugin API would only surface when someone tries to deploy.

Suggested shape

• New tests/test_openclaw_plugin_load.py reads openclaw.plugin.json, validates against a vendored JSON Schema (drop in tests/fixtures/openclaw-plugin.schema.json), asserts every declared skills[] path resolves, every mcpServers.<name>.command is invocable, and every contracts.mcpMethods[] entry exists in capabilities.METHODS.
• A reference fixture deployment under tests/fixtures/openclaw-plugin-real/ mimics OpenClaw's plugin loader minimal expectations.
• CI gate: this test runs on every PR touching openclaw.plugin.json or src/vouch/capabilities.py.

Acceptance

• A renamed slash command in adapters/ that isn't reflected in openclaw.plugin.json fails the test with a clear "manifest declares skill at but that file does not exist".
• A new kb.* method that isn't classified under contracts.mcpMethods fails the test (so the maintainer is forced to think about trust classification).

Out of scope

• A live OpenClaw deployment in CI — schema + reachability checks only.
• Versioned schema migrations for the manifest itself (the JSON Schema can evolve out-of-band).