Harden and package BeatAPI for Cursor, Grok Bot, and Grok Build

[erickkkyt]

Summary

• rename the cross-host package to beatapi-agent-plugin
• package one shared Skill and MCP runtime for Codex, Cursor/Grok Bot, and Grok Build
• add a Grok Build manifest and validator
• rebuild the README around project-native proof, four-host setup, runtime model discovery, API-key binding, and submission paths
• keep the checked-in OpenAPI copies byte-identical to the live BeatAPI contract
• expose 26 safe model-facing tools while keeping one-time-secret creation in trusted server-side code or the dashboard

Security hardening

• reject credential-like keys and values in open-ended model parameters
• confine uploads to explicit BEATAPI_UPLOAD_ROOTS and reject symlink escapes
• require explicit trust for custom HTTPS API origins
• require an absolute reviewed CLI path and pass a minimal child environment
• pin GitHub Actions to immutable commit SHAs

Depends on

• Update agent plugin for current BeatAPI capabilities #2
• Update Skill for current BeatAPI capabilities beatapi-skill#3
• Update client for current BeatAPI capabilities beatapi-cli#5

Verification

• npm run verify: 19/19 tests, contract/skill/runtime checks, Cursor and Grok validators, typecheck, bundle and release packages
• grok plugin validate .
• plugin-creator validation
• README checker: 0 errors, 0 warnings
• npm audit: 0 vulnerabilities
• release ZIP content and secret-pattern inspection

This PR prepares the repository for review. Marketplace submission remains a separate step after the dependency PRs land and the default branch is re-verified.