feat: show plugin and skill evidence in weekly intelligence

[Patrick-Erichsen]

What Problem This Solves

The intelligence dashboard now recommends both plugins and skills, while Hermit accepts only the original plugin-search digest.

Related: CLAW-893 under CLAW-724.

User Impact

Weekly intelligence can show separate plugin and skill recommendations, company opportunities, official gaps and movers, with signal reasons, counts, periods, freshness and explicit empty outcomes. Recommendations remain advisory; this receiver never changes Featured.

Deploy this receiver before the v2 ClawHub sender. Previously frozen plugin-only weeks keep their existing validation, rendering and origin/week receipt identity. A v2 payload cannot overwrite or resend the same legacy week.

Why This Change Was Made

ClawHub remains the single recommendation/classification owner. Hermit adds a strict, bounded v2 wire projection and Carbon renderer while reusing the existing authenticated endpoint and durable delivery owner. Search-only recommendations require three matched searches; adoption-supported candidates can show lower aggregate demand but never query text below three searches. Unknown evidence stays null, external source observation time stays separate, and whole omitted rows point to the dashboard.

No new environment setting, destination, scheduler, storage schema or receipt migration is introduced. Production growth adds the explicit nested v2 validation/rendering contract; the legacy validator is moved intact for reuse.

Evidence

• Before: original production handler rejects the generated v2 payload with HTTP400; a baseline legacy message creates one receipt. Empty v2 sections previously rendered only a title.
• After: upgraded handler rejects replacing that same legacy week with HTTP409, replays the legacy payload with HTTP200, and accepts the next-week v2 payload with HTTP200. A separate process then replays both weeks with zero additional transport calls; both receipts and an unrelated D1 key remain intact. Empty sections report their qualifying outcome explicitly.
• This upgrade proof uses actual persistent local Wrangler D1, localhost HTTP, the real receiver handler and generated ClawHub wire payload. Only Discord transport is replaced with an in-memory fixture. No Discord message was sent.
• Focused handler tests cover both catalogs, strict private/unknown fields, thresholds, origin/count consistency, text/byte caps, escaped mentions, legacy replay, response-loss recovery and empty sections. Exact-head Worker typecheck and deployment dry-run pass. The full suite passes: 310 tests, 185,032 assertions, zero failures; GitHub CI also covers the final candidate.
• Structured autoreview was scoped-clean at P0 on the substantive receiver change; the final empty-state wording was separately verified with a fail-before/pass-after test. Final focused tests: 20 pass / 158 assertions; maximum accepted empty example renders 3,643 text characters and 13 components.
• Root independently reviewed complete receiver/validator/docs source. Carbon Container/TextDisplay source and current Discord component limits were inspected.

Production verification: merged as 2b63770ff180480da927496a5175569bb900b87f. The automatic Cloudflare build succeeded; Worker version 81 (bf88c1cf-3af3-4cb5-a220-f1a2d9b4134c) serves 100% with the existing D1 binding. A read-only download of the deployed entry.js exactly matches the local verified build: 7,627,362 bytes, SHA-256 093d71c151910b08e90c591623e415e41065b72ee2f2a0325a44d755ccda1778. Authenticated production GET returns HTTP 405 before body parsing, receipts or transport. No digest POST or Discord send was performed.

Recorded delivery-proof gap: production bot-specific channel permissions, actual Discord create/readback, and real-Discord ambiguous-send recovery are not proven by this run. Saved credentials did not expose the actual Hermit bot token. This rollout follows the explicit production authorization while preserving the requested no-send dry run; local/mock proof is not represented as production Discord proof.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.