fix: Suppress bare .svc hostnames and pin lychee version

[rubambiza]

Summary

Fixes two false-positive classes in the link-health scanner reported by @esnible
(rossoctl/cortex#532, #533).

1. Bare .svc suppression gap. Cluster-local Kubernetes URLs such as
   http://keycloak-service.keycloak.svc:8080/realms/ were flagged as broken. They
   matched none of the existing suppression clauses (no .svc.cluster.local suffix,
   non-numeric so not RFC1918, resolve to nothing so --exclude-all-private misses
   them). Added a bare-.svc clause.

2. lychee version pin (defensive). Verified lychee 0.23.0 already excludes
   URLs inside code blocks by default (--include-verbatim opts them back in). Pinned
   a minimum version and documented the dependency so this cannot regress.

Changes

• Extracted the inline lychee-parsing/suppression jq program into a standalone,
  unit-testable scripts/extract-broken-links.sh; scanner now calls it (same
  append/error semantics).
• Added the bare-.svc suppression clause.
• New tests/test-extract-broken-links.sh (23 assertions): bare-.svc suppression
  plus regressions (.svc.cluster.local, .local, RFC1918 ranges stay suppressed;
  genuine internal/external broken links pass through with correct fields), edge
  cases (empty/missing error_map, non-URL entries), and the stdin (-) path.
• Pinned lychee >= 0.23.0 in docs/running-without-openclaw.md.

Testing

• bash tests/test-extract-broken-links.sh — 23/23 pass.
• bash tests/test-parse-diff-map.sh — 45/45 pass (no collateral breakage).
• End-to-end: a real lychee run (scanner args) on a bare .svc URL outside a code
  block extracts it into error_map; the extractor drops it (zero false positive).
• shellcheck clean on both changed scripts.

Fixes #23
Fixes #24

Assisted-By: Claude Code

[clawgenti]

Refactors bare .svc suppression into a standalone, unit-tested extractor — clean separation of concerns with solid test coverage. All checks pass. Ready for human review.

---

Reviewed by clawgenti using github:pr-review

[clawgenti]

nit: TMPDIR shadows the well-known $TMPDIR environment variable. Subprocesses called from this test script won't be affected (they run in sub-shells and the trap cleanup is correct), but renaming to something like TEST_TMPDIR avoids any confusion with the system env var.

[rubambiza]

Good catch — renamed to TEST_TMPDIR in bc7feab. Scoped to this new test file to keep the change focused; the sibling test-parse-diff-map.sh uses TMPDIR too but I left it out of this PR.

[clawgenti]

Clean refactor extracting the lychee-parsing logic into a standalone, unit-tested script — the bare .svc suppression fix is correct and both regex filters (line 66 and 67) are non-redundant. All checks pass. Ready for human review.

• The PR body states "17 cases" but test-extract-broken-links.sh contains 18 run_test calls (Test 5 expands to 6 sub-assertions). Minor doc discrepancy.
• The stdin (-) mode documented in the extract-broken-links.sh usage block has no corresponding test in test-extract-broken-links.sh.

---

Reviewed by clawgenti using github:pr-review

[clawgenti]

nit: The usage comment on line 5 says bash automation/tests/test-extract-broken-links.sh, and the script header documents a stdin mode (cat report.json | extract-broken-links.sh - ...) in the extractor, but there's no test exercising the - (stdin) path. Consider adding one to cover that code path.

[rubambiza]

Added a stdin (-) path test in c0eb93a — it pipes a fixture through the extractor and asserts the broken link is emitted.

[clawgenti]

nit: The usage block documents reading from stdin via -, but test-extract-broken-links.sh has no test for this path. The PR body also counts "17 cases" but there are 18 run_test calls — minor mismatch worth fixing in the PR description.

[rubambiza]

Both addressed: stdin (-) path now covered by a test in c0eb93a, and the PR body updated to "18 assertions / 18/18 pass" (the file has 17 run_test calls plus one inline stdin assertion; line 35 is the helper definition, not a call).

[clawgenti]

Adds a well-structured extract-broken-links.sh extractor with 18 tests covering the new bare .svc suppression and regression cases — clean extraction, correct fix. All checks pass. Ready for human review.

---

Reviewed by clawgenti using github:pr-review

[clawgenti]

nit: The unreachable path is covered, but the timeout, dns, and error (catch-all) status normalization paths in extract-broken-links.sh have no corresponding test cases. Consider adding fixtures for e.g. '{"text":"Timeout"}' → "timeout", '{"text":"DNS error"}' → "dns", and a non-matching text → "error" to complete the coverage.

[rubambiza]

Added in 91cad02: fixtures for the timeout, dns (both resolve and dns matches), and error catch-all text-status branches, plus a null-status case mapping to unknown. All status-normalization paths are now exercised (23/23 assertions).

[esnible]

Clean, well-scoped fix. I fetched the PR head from the fork and verified independently:

• All 23 tests pass locally (tests/test-extract-broken-links.sh); shellcheck clean on both changed scripts.
• The bare-.svc regex is precise. It suppresses foo.ns.svc[:port], .svc.cluster.local, .local, and RFC1918 ranges, and correctly passes through hostnames that merely contain .svc as a non-terminal label (foo.svc.example.com) or in the path (/foo.svc) — no over-suppression of real external URLs.
• Both .svc clauses are necessary. The bare-.svc regex does not match the .svc.cluster.local form (the char after .svc is ., not :///end), so neither suppression clause is dead code.
• stdin (-), file-path, and usage/missing-file exit codes all behave as documented.
• Error semantics preserved. The scanner still wraps the extractor call in 2>/dev/null || true, identical to the original inline jq — no regression.

The refactor into a unit-testable extract-broken-links.sh is faithful, status normalization is exercised across all branches, and the lychee >= 0.23.0 pin is a reasonable defensive note.

Assisted-By: Claude Code