Track remaining authenticated provider adapter work

[0thernet]

Outcome

Finish the remaining authenticated-provider adapter work under Wrench's public CLI and SDK authority.

Wrench already separates public capture, reviewed first-party authenticated APIs, and official provider APIs. The remaining work should preserve that separation while closing any contract, evidence, or documentation gaps in the current public adapters.

Scope

• Audit src/assets/adapters/**, src/providers/**, src/provider-contract-*.ts, and the capability projection for incomplete or inconsistent adapter coverage.
• Keep operations semantic (feeds.read, messaging.read, messaging.send, posts.publish, and similar outcomes) rather than exposing requests, selectors, cookies, or raw provider payloads.
• Treat captured traffic as inert evidence. Runtime requests must remain code-owned, strictly parsed, subject-bound, origin-bound, and fail-closed.
• Preserve explicit risk, preview, confirmation, durable dispatch, recovery, redaction, and receipt semantics for every write.
• Never silently fall back between public capture, first-party authenticated APIs, official APIs, or browser execution.
• Add deterministic fixtures and low-stakes live acceptance evidence for any adapter promoted from capture-required to observed.

Acceptance criteria

• Current adapters have one documented and tested contract state.
• capture-required paths remain network-inert.
• Authenticated paths bind the expected account and target before I/O.
• Drift, ambiguous responses, retries, and partial results fail closed with durable evidence.
• LinkedIn and X pressure tests exercise the same public CLI and receipt path users run locally.
• Public documentation explains the supported capability boundary without relying on repository-external context.