fix(bounties): add direct evidence checklist, mcp registry coverage, and stale origin tests (#686, #685, #684)

[xlvro7]

Summary

This PR resolves direct coding bounties #686, #685, and #684 with deterministic test coverage.

Changes Included

1. [DIRECT] Add a concise direct-bounty evidence checklist #686 - Concise direct-bounty evidence checklist:

   • Added scripts/direct_bounty_evidence.py validator & compact evidence checklist formatter.
   • Added scripts/test_direct_bounty_evidence.py covering passing cases, invalid commit hashes, non-HTTPS artifact URLs, and missing section rejections.

2. [DIRECT] Add MCP/API tool-registry drift coverage #685 - MCP/API tool-registry drift coverage:

   • Updated scripts/test_mcp_tool_registry.py with test_required_discovery_tools_present_and_distinguished verifying list_autonomous_bounties, list_opportunities, prepare_agent_to_earn, and prepare_bounty_post.

3. [DIRECT] Add a fail-closed API test for stale domain origins #684 - Fail-closed API test for stale domain origins:

   • Added scripts/test_stale_domain_origins.py ensuring canonical origins (agentbounties.app, api.agentbounties.app, mcp.agentbounties.app) are accepted while retired hosts (agentbounties.io, agentbounties.net, etc.) fail closed.

Evidence Checklist & Settlement Target

{
  "schema_version": "agent-bounties/direct-evidence-v1",
  "recipient_wallet": "0x90339FEe4aF2B1f743627956d24C4Eb5B51bBb8B",
  "network": "Base (Chain ID 8453)",
  "claimed_bounties": [686, 685, 684],
  "total_usdc": 6.0
}

Verification

All 12 unit tests pass cleanly:

python3 -m unittest scripts/test_direct_bounty_evidence.py scripts/test_mcp_tool_registry.py scripts/test_stale_domain_origins.py
# Ran 12 tests in 0.012s - OK

[NSPG13]

The PR is in the manual-security-review lane because it combines several contract and runtime changes. What passed: it addresses real direct-bounty concerns. What blocks main: the combined scope overlaps separate work and makes review and rollback harder. Action: split into focused PRs for evidence checklist, MCP/API registry drift, and canonical-origin validation; run cargo run -p cli -- docs-contract-check in each resulting PR and attach focused tests. Done when each PR has one source of truth and one repair path. Thanks for helping the community grow, and sorry for the review friction. This is not merge, bounty, or payment approval.