ci: add template validation workflow (Ajv + upstream schema)

[mrkhachaturov]

Summary

Adds a CI workflow that validates every bank template in this repo against the upstream HindSight schema on every PR and push. Before this, a contributor could merge a structurally broken template and nothing would catch it until HindClaw tried to import it at runtime.

Mirrors the upstream check-templates.mjs pattern from vectorize-io/hindsight#1065, adapted for this repo's flat layout.

Validation layers

1. Schema validation (Ajv) — compiles the upstream-generated bank-template-schema.json and validates each templates/*.json against it. Authoritative: upstream regenerates the schema from BankTemplateManifest.model_json_schema() on every PR via verify-generated-files, so it always matches the live Pydantic model.
2. Catalog integrity — templates.json has a templates array, every entry has id + manifest_file, IDs unique within catalog, every manifest_file ref points at an existing file, no orphan files under templates/.
3. HindClaw content guard — retain_extraction_mode ∈ {concise, verbose, custom, chunks}. Upstream's schema accepts any string; the runtime retain pipeline only honours those four values.

Files

File	Purpose
.github/workflows/validate.yml	Single job: setup-node + npm ci + curl the schema + node scripts/check-templates.mjs
scripts/check-templates.mjs	Validator — adapted from upstream's script for the flat layout, adds orphan detection + content guards
package.json / package-lock.json	ajv ^8.17.1 as the sole dev dep, "private": true
.gitignore	/node_modules/ and /bank-template-schema.json (fetched fresh each CI run)

Verified locally

All three committed templates (backend-python, fullstack-typescript, astromech-test) pass. Sanity-checked the negative paths:

• Schema error: planted disposition_empathy = "five" → caught with must be integer at /bank/disposition_empathy ✓
• Content guard: planted retain_extraction_mode = "verbatim" → caught with valid-values listing ✓
• Orphan detection: dropped an unreferenced file in templates/ → caught with explicit error ✓

Test plan

• Validator runs and reports all 3 templates valid
• curl fetches bank-template-schema.json from upstream main successfully
• npm ci resolves from the committed lockfile

Not included (deliberate)

• No pinned-schema fallback: we fetch from upstream main fresh each run. If upstream is down, CI is down — acceptable for now given upstream's uptime. If this bites, add a committed schemas/bank-template-schema.json + a cron job that PRs updates on drift.
• No Pydantic runtime validation: Ajv catches the same structural issues without requiring hindsight-api-slim install, and the runtime-only checks (mental-model ID regex, unique IDs, version validator) are already covered by upstream's schema where possible, and by the content guard for the one field that isn't.
• No generator: unlike upstream, this repo doesn't regenerate the schema — we consume it. Drift detection happens upstream; we just trust and use.

🤖 Generated with Claude Code