feat(package): add connect-my-stack (PDEC-9226)

[yourfriendmaya]

Summary

• add Connect My Stack v1.0.4 as a schema-v1 Runneth package using the runtime-supported package.json manifest
• register the manual-install/manual-update package in package-index.json
• align the repository validator and package docs with the deployed package CLI contract, including installPolicy
• install the complete connect-my-stack and tech-stack-scanner skill directories
• route own-site onboarding to connect-my-stack and reserve the standalone scanner skill for competitor/prospect research
• add a customer scanner mode with canonical Runneth categories and marketer-friendly ad-platform names
• separate Meta/TikTok as ad platforms provided through Motion while keeping Google/LinkedIn connectable
• for tools missing from the one-click registry, check for a usable API and offer customer-friendly Custom setup instead of immediately dead-ending them
• suppress technical evidence in the customer-mode human report
• replace relative scanner paths with stable installed paths
• block private, reserved, credential-bearing, and unsafe redirect targets
• remove cookie values from captures and restore TLS validation
• prefer an existing browser with fetch fallback and no runtime Playwright download
• retain Chromium --no-sandbox only for root-run container environments
• prevent matched network hosts from being reported as unmatched in every scanner mode

Validation

• node --test scripts/validate-runneth-package-index.mjs
• node --test packages/connect-my-stack/test/scanner.test.mjs
• JavaScript syntax checks, targeted security regressions, and git diff --check
• customer-mode regression coverage for category mapping, ad naming, Motion ad-platform separation, technical-evidence suppression, and unmatched hosts
• parsed the manifest and index with the actual agent-builder runtime Zod schemas
• installed v1.0.4 with the actual Runneth installLocalPackage implementation into an isolated temporary agent root: 7 files installed successfully

Package policy

• installPolicy: manual
• updatePolicy: manual
• uninstallPolicy: allowed
• source ref: main, per the package contract

Tested locally. Convos:

• https://projects.motionapp.com/organization/65b38333158ebbba50f27788/65cbcb84095884aaf08dc76a/chat/611ff9f7-8293-4356-ab49-f24332a2a2c9
• https://projects.motionapp.com/organization/6196dde3af83c20007ec74eb/6424a223ab8613ce345f95b9/chat/2fe508d0-06ee-45f2-8f32-6044a18cc3c9
• https://projects.motionapp.com/organization/65b38333158ebbba50f27788/65cbcb84095884aaf08dc76a/chat/6cd1f64e-701f-42a9-9cf7-b096d245e927

[thedumsieffect]

Package manifest/index wiring looks compatible with the v1 runtime.

Requesting changes before rollout:

• Move scanning behind an isolated network boundary with DNS-rebinding protection, sandboxed browser execution, deadlines, and response limits.
• Use an explicit allowlist so infrastructure is never presented as connectable.
• Let this skill own sequencing while core Runneth owns connection requirements and secure UI; preserve and resume the queue after connection events.
• Fix browser failure status, path-sensitive evidence retention, matched-host tracking, and customer totals.
• Run scanner tests in required CI and add regression coverage for the security/correctness fixes.

Config notes: installation and updates are manual, staging must read the staging catalog, new skills require a fresh session, and browser capture currently lacks runtime dependencies.