ci: validate the template on every PR; fix hook script paths and permissions; add LICENSE

[deanrie]

Summary

Four things a fresh clone of the template gets wrong today, fixed together because they all touch how the starter is validated and run:

• No CI. The README's checklist says node scripts/validate-template.mjs must pass, but nothing runs it: the repo has no workflows, so PRs (Replace placeholder logos with Cursor avatar PNG #1, Fix: Support single plugin validation without marketplace.json #8, Add Agent Plugins starter template #11) are never checked. Adds .github/workflows/validate.yml running the validator on pushes to main and on pull requests. The validator has no dependencies, so no lockfile is needed.
• Hook scripts are not executable and are addressed relative to the cwd. plugins/starter-advanced/scripts/*.sh are committed as 100644, and hooks.json calls them as ./scripts/format-code.sh. Plugin hooks do not run from the plugin directory, so the template ships hooks that fail with exit 127 (and Permission denied even from the right directory). Switches them to bash "${CURSOR_PLUGIN_ROOT}/scripts/<name>.sh", the form used across cursor/plugins (see fix(advisor): address hook scripts via CURSOR_PLUGIN_ROOT plugins#315 for the background), sets the executable bit, and adds the required "version": 1 to hooks.json.
• The manifest did not reference the hooks or MCP config. starter-advanced/.cursor-plugin/plugin.json has no hooks / mcpServers fields. Cursor discovers components from their default directories, so this is not a loading failure, but the template is meant to show the manifest shape, and the other fields (logo) are already explicit. Adds "hooks": "./hooks/hooks.json" and "mcpServers": "./mcp.json" so the manifest documents what the plugin ships. (Correction: an earlier version of this description claimed neither would load without the fields; the docs say default directories are discovered.)
• No LICENSE. Both starter manifests declare "license": "MIT" while the repository itself has none. Adds the MIT text.

Verification

• node scripts/validate-template.mjs: Validation passed (the one remaining warning is the expected "starter-simple has no mcp.json").
• git ls-files -s plugins/starter-advanced/scripts: all three scripts now 100755.