[abrahamhl]

Goal

Replace the paid/cloud-gated Ultimate Web Scraper path with a current, pinned open-source acquisition layer and centralize the surrounding context, memory, graph, security, agent/skill discovery, loop and observability policies in the existing AI Forge control plane.

What this adds

• Scrapling 0.4.15 as primary web MCP; Crawl4AI and Browser Use as on-demand fallbacks.
• Core profile: abraham-os + Context Mode + codebase-memory-mcp.
• Deep-code profile: Graphify.
• Cyber profile: Promptfoo + Trivy + Gitleaks admission/eval gates.
• Optional IBM ContextForge gateway; MetaMCP explicitly not selected as primary while its OAuth-token access-control issue remains open.
• OpenTelemetry/Langfuse observability catalog; existing Session Evidence Fabric remains canonical evidence.
• Discovery registries for MCPs/skills/cyber agents, metadata-only until quarantine/review.
• Windows bootstrap/doctor and disposable client-config exporter for Claude/Cursor/LM Studio, VS Code, Gemini and Codex.
• pnpm-only Node policy and removal of npm from harness scripts.

Safety/performance model

• Lazy profiles; never load every MCP globally.
• Pinned versions; no unreviewed marketplace auto-install.
• Quarantine -> scan -> schema review -> least privilege -> healthcheck -> audit.
• stdio preferred locally; public unauthenticated MCP forbidden.

Verification boundary

This PR wires the repository-side control plane. It deliberately does not claim that third-party binaries are already running on Abraham's Windows host. Machine activation is proven only after the local bootstrap, client restart/handshake and audit evidence.

Follow-up

Generate and validate the real pnpm lockfile locally, run build/tests, then remove the historical package-lock in a separate audited commit. Do not fabricate a pnpm lockfile remotely.