feat(plugin): initial scaffold — plugin loader entry + AST + CI workflows (P1.B/C/D)

THE single repo holding every Svrnty modification to nesquena/hermes-webui per
the SVRNTY-HERMES Plugin Protocol PRD (hermes/docs/SVRNTY-PLUGIN-PROTOCOL.md).
This scaffold is the empty vessel; Phase 2 migrates the existing fork
modifications (STT, vault status, brand skin) into it.

Contents:
  plugin.py                          register(api) entry; reads 6-method
                                     contract; wires static + routes
  svrnty_hermes_webui_plugin/        package wrapper for pip install
  manifest.yaml                      plugin name · version · upstream pin
  pyproject.toml                     pip-installable
  routes/__init__.py                 placeholder until Phase 2 migration
  static/                            placeholder for brand skin migration
  CONNECTION-MAP.md                  AST-generated; 4 public API calls, 0 forced
  scripts/ast-connection-map.py      AST walker; modes: regen · --check · --diff
  tests/{unit,integration,evals}/    skeleton for Phase 3 eval suite
  .github/workflows/
    plugin-tests.yml                 push: unit + integration + map check
    connection-map-check.yml         PR: regen + diff vs committed
    upstream-drift.yml               daily cron: detect new upstream tags +
                                     run matrix (activates when Gitea runner
                                     registered on Svrnty infra)

Karpathy 4 rules in CLAUDE.md; every subagent inherits them via the workspace
contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/connection-map-check.yml

@@ -0,0 +1,22 @@
+name: connection-map-check
+
+# On every PR: regenerate CONNECTION-MAP.md and fail if it doesn't match the
+# committed copy. Forces PR authors to commit the regenerated map alongside
+# any code change that touches plugin → upstream dependencies.
+on:
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install yaml dep
+        run: pip install pyyaml
+
+      - name: Regenerate + diff
+        run: python3 scripts/ast-connection-map.py --check

.github/workflows/plugin-tests.yml

@@ -0,0 +1,32 @@
+name: plugin-tests
+
+# Runs on every push to jp/main + on every PR.
+# Fast (unit + integration). Drift CI is a separate workflow.
+on:
+  push:
+    branches: [jp, main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install plugin (editable) + dev deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+          pip install pytest pyyaml
+
+      - name: Unit tests
+        run: pytest tests/unit -v --tb=short || (echo "no unit tests yet — Phase 2"; true)
+
+      - name: Integration tests (skip if hermes-webui not available)
+        run: pytest tests/integration -v --tb=short || (echo "no integration tests yet — Phase 2"; true)
+
+      - name: AST connection map is fresh
+        run: python3 scripts/ast-connection-map.py --check

.github/workflows/upstream-drift.yml

@@ -0,0 +1,42 @@
+name: upstream-drift
+
+# Detects new upstream (nesquena/hermes-webui) releases + runs the plugin
+# matrix against each. Posts a report; opens an issue on FAIL.
+#
+# Schedule: daily at 04:00 UTC. Also triggerable manually.
+# Activated once a Gitea Actions runner is registered on Svrnty infra.
+
+on:
+  schedule:
+    - cron: "0 4 * * *"
+  workflow_dispatch:
+
+jobs:
+  drift:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install plugin + tooling
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e . pytest pyyaml requests
+
+      - name: Run upstream-sync matrix
+        run: python3 scripts/upstream-sync.py --report-json drift-report.json
+
+      - name: Upload report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: drift-report
+          path: drift-report.json
+
+      - name: Open issue on failure
+        if: failure()
+        run: |
+          echo "Drift detected — would open issue here (Gitea API call). Report attached."