setup-auditlisted

Audit optional capabilities. The pipeline runs fully without any of them — the audit determines *which rung* each task runs at. Load `method-rules` first. ## Rules of evidence for capabilities A capability is `available` ONLY after an **authenticated functional probe** — a real call that succeeded. "CLI installed" or "user says they have an account" is NOT available; record those as `status: unavailable|unknown` with rung `handoff` and a note. Every probe result is recorded with a timestamp. ## Probes (never let a failed probe error out the audit) 1. **Scraping** — ToolSearch for scraping/crawl MCP tools (e.g. firecrawl). If found: one trivial real call (scrape a stable public page). Success → `available`, rung `enhanced-auto`. Not found → tell the user which MCP server to install if they want it; status `unavailable`, mining runs `baseline-auto`. 2. **Secondary LLM (multi-model eval)** — two qualifying paths, checked in this order via Bash: (a) standard keys in the user's own environment (e.g. `OPENAI_API_KEY`, `GEMINI_API_KEY`); (b) a logged-in **Codex CLI** (`codex --version` and `codex login status` both succeed) — the common case for a founder on a ChatGPT plan who owns no API key. Neither check is itself the probe: installed-and-logged-in is `status: unknown`, rung `handoff`, exactly like an unauthenticated hosting CLI. Ask before the one minimal authenticated call that decides it (`codex exec` spends the user's own quota). Record provider + model — `codex-cli/<mode