feat(crm-cleanup): execute source-backed cleanup

[abisaelautomation-sys]

Summary

Implements the CRM cleanup bounty path as an executable skill run instead of a proposal-only graph:

• fetches current CRM records from a public HTTPS source at runtime;
• reconciles transcript evidence against an explicit crm_schema.allowed_fields allowlist;
• executes accepted updates through a bounded mock-crm transport;
• returns before/after write evidence, source digest evidence, confidence, review gate, and an honest hosted_harness_status label;
• routes uncertain/hedged transcript evidence to needs_review without applying a write.

This is for Frantic bounty #79 / auscaster/frantic-board#194.

Validation

• node --check skills/crm-cleanup/crm-cleanup.mjs
• runx harness skills/crm-cleanup --receipt-dir .runx/harness-receipts --json with runx-cli 0.8.2 — passed 3 cases
• pnpm typecheck
• git diff --check

Harness receipt ids from the passing run:

• sha256:67849fa6d34945031a6bc993b684d24a1ff9fe0ac47f475c7e8f7a5c508109cb
• sha256:693349d25b86fb9c49bfda3da7b0de5aa0f7fa1510ded45477063ada432d9483
• sha256:8d823f4f4acb9e2c034b95be669e6fc36c93e9223ddb4012f7bc0626bd1a2cb1

[abisaelautomation-sys]

Registry publish is currently blocked for this PR.

Evidence from my side:

• Timestamp: 2026-08-12T14:12:36Z
• CLI: runx-cli 0.8.2
• Command: runx registry publish .\skills\crm-cleanup --registry https://api.runx.ai --version 0.2.0 --json
• Endpoint used by the CLI publish path: POST https://api.runx.ai/v1/skills
• Result: HTTP 500 / Internal Server Error
• Sanitized CLI output:

{
  "error": {
    "code": "registry_error",
    "message": "runx API registry publish returned HTTP 500: Internal Server Error"
  },
  "status": "failure"
}

Related checks:

• runx registry search crm-cleanup --registry https://api.runx.ai --json works.
• runx registry read abisaelautomation-sys/crm-cleanup@0.2.0 --registry https://api.runx.ai --json returns not found.
• https://runx.ai/x/abisaelautomation-sys/crm-cleanup@0.2.0 returns 404.
• Local validation is green: node --check, runx skill inspect, runx harness 3/3, dogfood sealed, runx verify, pnpm typecheck, and git diff --check.

The CLI error does not expose a request id/correlation id for the failed POST, and I am not including any tokens or auth headers here.