docs/13-plugins.md caps timeout_secs at 300, but validate only rejected
zero. Oversized values loaded and plugin.list reported them while
run_hook silently clamped. Reject 1..=300 at parse so broken manifests
fail their own package like other schema errors.

Co-authored-by: Grok Bot <grok-bot@users.noreply.github.com>