Port agent-connectors into monorepo, SDK v2

Original work item (epic Task 10454, verbatim): - Remove Draft state from anywhere of the jaah-ce, agent-sdk, agent-connectors. It needs to be removed at the source and then propagated using standard mechanism - remove any references on the source of documents (especially do not mention any brands) - agent-sdk. must borrow and share the process from jaah-ce, as well as terms. We want them mirrors from the main repo. Only main branch for now - do we want the same with agent-connector? make sure it is up to date with agent-sdk - Look for any sensitive or internal information or any brands - scrub all old versions from all three repos Full settled inputs: the epic's `prd` and `architecture` artifacts (Task 10454; read with `task_read`/`artifact_read`). Decisions quoted below are verbatim from them. Child C — Connectors into the monorepo, ported to SDK v2 (architecture §1.5). Builds on Child A's manifest schema and `mirror-publish` action. Requirement (PRD verbatim): R4 "agent-connectors' full current content (connectors, fixtures, tools, CONTRIBUTING, GOVERNANCE, `.github/`) lives in the monorepo and is published to `agent-connectors@main` by the R3 mechanism. Every connector and fixture declares and runs on SDK v2 (manifest 2, ACP), keeping each one's current behaviour (codex-reference: works a task, asks when blocked, reports usage, delivers a PR, honours the security gate; report-sample: uploads an HTML report and settles; each fixture: its deliberate failure). Its checks (`check_connectors.py`, tests) run in the monorepo's gate." Build: - Home `packages/agent-connectors/` (self-contained, imports nothing from the repo), content copied from `jaah-ai/agent-connectors@develop` (read via `jaah-forge api get`/clone; never write to that repo): `connectors/{codex-reference,report-sample}`, `fixtures/{broken-manifest,exit-unsettled,py-hello,ts-hello}`, `tools/check_connectors.py`, `tools/tests/`, CONTRIBUTING, GOVERNANCE, `.github/`. - Port: each `jaah-agent.toml` → `manifest = 2` with `command = [...]`; `entrypoint`, `sdk`, `[runtime] install` go; `maintainer = "@jaah-ai"`. Each agent rewritten as a `jaah_agent.Agent` prompt handler over the `_jaah.ai/*` extension (`task/complete`, `task/fail`, `artifact/upload`, `input/request`, `pull_request/enqueue`; usage via ACP usage updates). Behaviour unchanged. - Bundle seam: `python packages/agent-sdk/examples/vendor.py [AGENT_DIR ...]` — no args = today's two reference agents; each `AGENT_DIR` gets the Python or TS bundle by its manifest `language`; output git-ignored. - `packages/agent-connectors/mirror.toml` (A's manifest schema, `[mirror] title = "Jaah Agent Connectors"`, a `generate` step calling the vendor seam) and `.github/workflows/agent-connectors.yml` (`workflow_dispatch` only, `publish` choice `none` | `agent-connectors-mirror`, check-only default, calls `.github/actions/mirror-publish` with `vars.MIRROR_DEST` / `secrets.MIRROR_DEPLOY_KEY`, plus the `root_reset` input like A's workflows). - Mirror CI `packages/agent-connectors/.github/workflows/ci.yml` (published, never run in the monorepo): tests against the vendored SDK inside each generated connector folder; no SDK checkout, no deploy key; the `review/**` branch flow, `SDK_REF` and `AGENT_SDK_DEPLOY_KEY` go. - CONTRIBUTING/GOVERNANCE (A4): fork PRs welcome; an accepted PR is re-applied in the source by a maintainer and appears in the next release snapshot; the PR is then closed with a link to that release. The bounty template stays only if it names no person. READMEs name Ref `main` (S5), never `develop`. - Gate: new full-tier stage "Agent connectors suite" in `tools/check.sh` next to `agent_sdk_stage` (~`:1059`): generate bundles, run `check_connectors.py` and the connector and fixture tests under the vendored SDK. - If B has merged first, the connectors tree must pass the gate's sensitive stage; add baseline rows only for hits D/E3 will clear, and name them in the PR body. Credentials & reach: - AC3/AC5/AC7 read oracles (branches, commits, tags, releases, file contents) | the runner's `jaah-forge` (task forge auth), GitHub API | **verified**: `jaah-forge api get repos/jaah-ai/agent-connectors/git/trees/develop` and `repos/jaah-ai/jaah/environments` answered - `./dc check full`, unit and gate oracles | nothing beyond the worktree | n/a - AC4 live codex-reference flow (merged PR on dev) | a Codex/OpenAI credential on a dev node, plus a dev project | **deferred**: the operator answered "We can skip it" (A8). Named behaviour tests in C replace it. Out of scope: - Do NOT retire SDK v1 on node/CP (Child F) or touch `apps/web` connector links (F). Do NOT write to `jaah-ai/agent-connectors` or create its environment/deploy key (H). Do NOT change the SDK v2 API. - Do NOT rename or change the product's `draft` task state or the SDK spec's "draft task" wording (D1). - Do NOT change any repo's visibility (D8); do NOT publish packages to PyPI/npm. - Do NOT relicense agent-sdk or agent-connectors (Apache-2.0 stays); do NOT change the CE license's terms beyond removing the draft banner and origin line. - Do NOT remove functionally required third-party names (S1) — provider CLIs, protocols, dependencies, forge names. - Do NOT edit monorepo files that ship to no mirror for §5 hygiene (S2) (the `skynet` rename alone is exempt, A2); do NOT rewrite the monorepo's own history. - Do NOT change jaah-ce's `ce-staging` environment or the edition seam / API cut. - Do NOT edit the mirrors directly except the one-time history reset and branch/tag/release/package deletion in R5; every content change lands in the monorepo and reaches the mirror by its publish workflow. - Do NOT change the SDK v2 API or the `jaah.ai` extension spec semantics. - Do NOT write to any mirror repo before the final publish child (A5). Done means: - AC4, local part (PRD verbatim): "`ls packages/agent-connectors/connectors` (or the Architect's chosen home) lists `codex-reference report-sample`; every `jaah-agent.toml` declares manifest 2 / SDK v2 (no `sdk = ">=0.1`); the connectors' tests pass in `./dc check full`." — oracle: run `ls packages/agent-connectors/connectors`, `grep -rn 'sdk = ">=0.1' packages/agent-connectors` (zero), every `jaah-agent.toml` under `packages/agent-connectors` contains `manifest = 2`, and the new gate stage. - Behaviour tests (architecture §1.5, each under the vendored SDK against a fake Codex CLI and a fake node): codex-reference (1) works a task and calls `pull_request/enqueue`; (2) sends `input/request` when the CLI reports it is blocked, then resumes with the answer; (3) emits an ACP usage update carrying the CLI's token counts; (4) refuses at the security gate and settles with `task/fail` naming it. report-sample uploads an HTML `report` that renders readably and settles `no_pr`. Each fixture produces its deliberate failure; `broken-manifest` yields one sentence per bad field. Cite each test name and pass. - `tools/manifest_check.py` (conformance) passes for each connector; `python packages/agent-sdk/examples/vendor.py packages/agent-connectors/connectors/*` generates bundles; mirror build of `packages/agent-connectors/mirror.toml` succeeds and A's determinism test covers it. - AC4 live report-sample/codex-reference flows on dev (deferred — runs in Child H after the publish; codex-reference live deferred per A8). - `./dc check full` green in the merge lane.