@plugin-creator validator rejects supported plugin hooks manifest field

Summary

The bundled @plugin-creator sample still treats hooks as an unsupported plugin manifest field, but current Codex plugin documentation and runtime code support plugin-bundled hooks.

This creates a false-negative validation failure for valid plugin manifests that include:

{
  "hooks": "./hooks/hooks.json"
}

Evidence

Current official documentation:

• Build plugins says plugins are appropriate when authors want to package lifecycle hooks: [https://developers.openai.com/codex/plugins/build](<https://developers.openai.com/codex/plugins/build>)
• Hooks says installed plugins can bundle lifecycle config through their plugin manifest or a default hooks/hooks.json file: [https://developers.openai.com/codex/hooks](<https://developers.openai.com/codex/hooks>)

Current open-source runtime also supports plugin hooks:

• codex-rs/core-plugins/src/manifest.rs parses hooks in plugin manifests.
• codex-rs/core-plugins/src/loader.rs discovers default hooks/hooks.json.
• codex-rs/plugin/src/load_outcome.rs exposes effective_plugin_hook_sources.
• Historical PRs: [#19705](<https://github.com/openai/codex/issues/19705>) discovered hooks bundled with plugins; [#22549](<https://github.com/openai/codex/issues/22549>) enabled plugin hooks by default; [#26272](<https://github.com/openai/codex/issues/26272>) optimized hook-only plugin loading.

Current @plugin-creator content still says otherwise:

• codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md says to omit unsupported fields including hooks.
• codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md says validation rejects unsupported manifest fields such as hooks.
• codex-rs/skills/src/assets/samples/plugin-creator/scripts/validate_plugin.py excludes hooks from allowed top-level manifest keys.

Reproduction

1. Create or install a valid local plugin with .codex-plugin/plugin.json containing "hooks": "./hooks/hooks.json".
2. Ensure hooks/hooks.json exists and contains a JSON object.
3. Run:

python3 codex-rs/skills/src/assets/samples/plugin-creator/scripts/validate_plugin.py <plugin-root>

Expected: validation accepts the supported hooks field.

Actual: validation fails with:

plugin.json field `hooks` is not accepted by plugin validation

Minimal Fix

Keep the scaffold behavior unchanged, but update the sample skill and validator so they match the current plugin contract:

1. Remove the SKILL.md instruction that says hooks is unsupported.
2. Update plugin-json-spec.md so hooks is described as a supported manifest field.
3. Add hooks to the validator's top-level allowed keys.
4. Validate hook path values as in-archive JSON files.
5. Accept inline hook config objects and arrays, matching the runtime manifest parser.

I have a local three-file patch for that shape and verified it against a real plugin manifest containing "hooks": "./hooks/hooks.json".

Related but Distinct

openai/codex#16430 tracks plugin hook runtime behavior and is covered by the broader hooks tracker openai/codex#21753. This issue is narrower: the bundled @plugin-creator sample/validator now lags behind the documented and implemented plugin manifest contract.