[pushkarsingh32]

中文摘要： 为 YouTube 增加一个单独的 transcript 动作：读取用户自己配置的托管转录 API（需要 Key），由服务商取字幕，本机不向 YouTube 发请求。它不是 yt-dlp 失败后的自动回退（PLATFORM_BLOCKED 仍是最终错误），也不会在多个服务之间自动切换。相关：#774。

---

Refs #774.

What it adds

agent-reach youtube transcript <link|id> [--lang en] returns the transcript from a hosted transcript API the user configured. The provider fetches the captions, so nothing is requested from YouTube on this machine. That is the case #774 and #566 describe: on a VPS every local route hits the bot check together.

• A separate action, not a fallback. PLATFORM_BLOCKED stays a final error with its "do not switch backends or retry" hint. The new action only runs when an agent or the user picks it, the same way transcribe only runs when picked.
• Vendor-neutral. Providers are one entry each in PROVIDERS in agent_reach/hosted_transcript.py (endpoint, how to build the query, how to read the reply). With one provider in the table it is used automatically; with several, agent-reach configure transcript-api-provider <name> is required and the NEED_SETUP hint lists the valid names. No provider is a hardcoded default, and there is no silent switching.
• Keys. agent-reach configure transcript-api-key, stored like groq-key. It is sent only as an Authorization: Bearer header, never in the URL, and never appears in an error message or hint (there is a test for each).
• Errors use the existing codes: no key or a refused key or no quota (401/402/403) is NEED_SETUP with a hint specific to that case, 404 is NOT_FOUND, 429 is RATE_LIMITED, timeouts are TIMEOUT, anything else is UPSTREAM_BROKEN. The provider's own message is passed through, capped at 200 characters.
• No new dependency (requests is already used by transcribe.py). The endpoint is a constant in the table, so a user-supplied URL is never fetched.

Files: hosted_transcript.py (new), the transcript action in channels/youtube.py, two keys in CONFIG_KEYS and the configure help line, the YouTube row in capabilities.md, an Unreleased entry in CHANGELOG.md.

How it was tested

• ruff check agent_reach tests clean, mypy agent_reach clean, pytest 500 passed (Python 3.13 locally; CI covers 3.10 to 3.12).
• 24 new tests (500 total against 476 on main), the HTTP call injected: success, missing key, unknown provider, several providers with and without a choice, each status code, non-JSON and oddly shaped replies, timeouts, key never in the query string or in any message, non-YouTube targets rejected before any request. Putting the key into the query string makes the key test fail (checked by hand).
• Run through the real CLI against a live provider with a real key: a successful transcript (backend: hosted), a rejected key, a video id that does not exist, a non-YouTube link, and an unknown provider each return the expected code. The only provider in the table was exercised live; a second provider is covered by the injected-HTTP tests only.

Relation to #800

#800 addresses the same issue with an Apify-only registry. It was written against the pre-1.6 layout: it is now 64 commits behind main and conflicts in six files (and references/video.md no longer exists), so it cannot merge as is. This PR is the same vendor-neutral idea on the 1.6 action and backend contract. If you prefer #800's registry shape, a second provider here is one entry in PROVIDERS, so the two can be combined. I am happy to adapt this either way.

Disclosure

I run getyoutubetranscript.com, the only provider in the table at the moment, so please weigh this accordingly. If you would rather ship the table empty and let each service add its own entry, I will remove it.