[bewaterhere-coder]

Summary

• Correct the public project-path schema regex so it rejects .. traversal segments, backslashes and NUL characters, matching the runtime path validator.
• Reject whitespace-only professional_guidance fields in runtime validation and JSON Schema.
• Replace the old test that explicitly accepted whitespace-only guidance with rejection tests and schema/runtime parity cases.
• Correct the English README, plugin authoring guide and extension contract: discovery suggests plugins, while explicit Profile selection independently activates professional guidance.

Why

The published JSON Schema accepted paths such as ../outside, a/../b and backslash paths even though the runtime rejected them. Contributors relying on the Schema could therefore publish manifests that fail at load time. The runtime and Schema also accepted whitespace-only guidance fields, allowing meaningless IDs and signals. The English docs additionally contradicted the current explicit-selection behavior.

Boundaries

• No manifest version or public API change.
• External plugin code remains metadata-only and is never executed.
• Discovery remains recommendation-only; explicit Profile selection controls professional guidance.
• All findings remain advisory and non-blocking.

Validation

Python 3.10–3.13, manifest schema/runtime parity tests, MCP stdio E2E and Sample Project Advisory.