[Knapp-Kevin]

Closes #582 after merge.

Bounded exact-pin source vetting

• Temporal 4/4 first-class candidates at registered openai/plugins@0722921d5542fc593105c27bd52630babd8b8c2a; skills tree 25fe264d72e1e268560f0c2b694ec5506f8a05bb. 3 REFERENCE-ONLY / 1 REJECT unchanged; no admission, copying or source pin change.
• All four exact package trees and SKILL.md blobs, declared skill versions, MIT license text, path freshness, dependency inventory, scores, controlled tags, authority/privacy findings and explicit security/behavioral not-run are in the macro review.
• Denominator accounting: OpenAI plugin finite intake 115/115 (15 families) → 119/119 (16 families); 46→49 REFERENCE-ONLY, 69→70 REJECT unchanged. Admitted-source denominator delta 0; provenance/verification delta 0/0; public inventory unchanged 44/995/1039, 23 registered sources, 12 pinned corpora.
• Macro findings: cloud namespace/API-key creation treats generic tool permission prompts as billable action approval; Temporal Ops has strong destructive safeguards but unbounded private diagnostic reads and memory retention; serverless explicitly approves initial resources but does not separately gate live Worker version cutover. Safe source-owned token capture and deterministic workflow diagnosis remain valuable reference material. Complete plugin-local MIT terms are present.
• Passive architecture: six passive files only (one review + five public accounting surfaces). No scripts, runtime, CI, scanner, scheduler, generator, source vendoring or execution. Source-owned provision.sh was statically inspected only.
• Stale accounting corrected: CURATION_QUEUE.md active Next action was incorrectly stuck at 106/106 (14 families) after the 115/115 iOS tranche; now 119/119.
• Concurrent lanes: existing drafts fix: integrate 29 passive first-party authority repairs into one exact-package qualification frontier #489/fix: prevent secret-fragment leakage and unscoped private reads in five first-party skills #492/fix: scope automation receipt reads and task-surface cross-repo writes (#495) #496 and feat: add passive trust-boundary and data-lifecycle review skills (#406) #412/feat: add passive behavioral evaluation and release-evidence protocols (#406) #413 untouched. The 36 final first-party repair packages still require external pinned SkillSpector v2.12.0 reports and independently executed adversarial acceptance; this PR does not waive that gate.

Review before merge

• Six changed paths, no first-party SKILL.md or registry companion changes.
• Five public surfaces agree on 119 decisions; index.json 16 family denominators sum to 119, 49+70=119.
• Main/head, reviews, threads, statuses, workflow runs and mergeability must be rechecked; merge only if still current and authorized.