chore: pre-submission polish — accuracy, hygiene, CI

[ryanio]

Summary

Audit pass before this template ships to ClawHub / Pinata. Three buckets: accuracy (claims that didn't match the code), hygiene (stale files, missing license, schema gaps), and CI (so the next change can't silently break the manifest or workspace shape).

Accuracy

• README: drop the OpenSea Stream API moat claim. HEARTBEAT.md step 4 polls events by-account over REST. The skill ships a stream client, but nothing here wires it up — heartbeat agents don't keep a websocket open. Soften the marketing line.
• Sell-side WETH caveat made concrete. Previously a one-liner ("Sell-side always confirms"); now spells out why — Privy's native-value cap doesn't constrain WETH transfers, which is how Seaport offer acceptances pay out.
• Repo layout block in README now lists manifest.json, LICENSE, the runtime memory/ dir, and notes that BOOTSTRAP.md self-deletes after first run.

Hygiene

• Remove .claude/settings.local.json — leftover migration permissions (git submodule *, mv .git/modules/...) from the ClawHub move. .gitignore already lists .claude/; this slipped in earlier.
• .gitignore paths fixed (memory/* → workspace/memory/*, matching where the agent actually writes).
• workspace/memory/.gitkeep so the dir exists at deploy time.
• manifest.json: drop empty scripts.start, add template.version: "1.0.0".
• Document memory/scan_state.json in AGENTS.md — HEARTBEAT.md referenced last_drop_scan / last_trending_scan with no defined storage. Now schematized; HEARTBEAT updated to point at it.
• Drop the opensea-get.sh /api/v2/events/accounts/... fallback in HEARTBEAT step 4 — canonical CLI is canonical, fallback was noise.
• Add LICENSE (MIT, matching the OpenSea skill).
• Add CONTRIBUTING.md covering versioning, validation, secret hygiene, and the skill-vs-template boundary.

CI

• .github/workflows/validate.yml:
  • jq shape checks on manifest.json (every required key + types, slug regex, semver regex on template.version, ClawHub slug regex on every skill).
  • jq shape check on .openclaw/openclaw.json.
  • Presence check on required workspace files.
  • Python link-checker (.github/scripts/check_links.py) verifies every relative .md link in README.md, CONTRIBUTING.md, workspace/, and .openclaw/ resolves to a real file. Skips skills/opensea/* (mounted at deploy time).
• Validations all pass locally on this branch.

Test plan

• CI runs and passes on this PR
• Skim README for the new sell-side caveat reading correctly
• Confirm the template.version field is the right shape for OpenClaw / Pinata (vs. the existing top-level schema version: 1)
• After merge, tag v1.0.0 and re-deploy through Pinata to confirm the manifest still attaches the ClawHub skill cleanly

🤖 Generated with Claude Code