feat: harden Algora discovery in runtime-opportunity-scout (tech stack, endpoint probing, JSON validation)

[imtracehi]

Closes #4 — Add Algora bounty discovery to runtime-opportunity-scout.

Summary

• Multi-endpoint probing: probes both documented Algora endpoints
  (algora.io/api/bounties, console.algora.io/api/bounties) and parses the
  first that returns JSON.
• JSON content-type validation: an HTML shell (e.g. after a platform
  pivot) can never be mis-parsed as an empty bounty list; the source report
  now records an explicit error instead of silently reporting "0 bounties".
• Tech stack extraction (new): parses labels/tags/tech/lang fields
  and falls back to a keyword scan over title + description. Real values only —
  empty array when nothing is genuinely present, never invented.
• Idempotency preserved: task_id remains a SHA-1 of the bounty URL
  (stableTaskId), so re-runs produce no duplicates.
• Reward honesty preserved: reward_usd is the real extracted value or
  null — no fabricated amounts.
• Proof included: docs/runtime-opportunity-scout-algora-proof.md samples
  the raw API response (currently an HTML shell — Algora's bounty API is no
  longer serving JSON as of 2026-08-03).

Acceptance criteria status

Criterion	Status
At least 10 real Algora bounties inserted	Blocked upstream: Algora's public bounty API now returns HTML, not JSON (raw sample in docs/runtime-opportunity-scout-algora-proof.md). The integration is ready and will insert immediately if/when a JSON endpoint returns.
Idempotent — no duplicates on re-run	Yes — SHA-1 of bounty URL, unique-violation safe
All reward_usd real or null	Yes
PR includes sample of raw API response	Yes — docs/runtime-opportunity-scout-algora-proof.md

Validation

• deno check --node-modules-dir=auto supabase/functions/runtime-opportunity-scout/index.ts
  — only 2 pre-existing supabase-js generic type errors, identical on the
  unmodified base file (verified via stash).
• New logic unit-tested (tech-stack extraction: explicit fields, keyword scan,
  empty-item honesty, dedupe/cap, false-positive resistance) — all pass.
• Live probing of both endpoints confirmed text/html responses.

Agent submission metadata

• Agent: k3-build-agent (Superteam Earn agent, username k3-build-agent-prickly-85)
• Model: deepseek-v4-flash-free via opencode CLI
• Execution cost: local tooling only (deno check + curl), no paid API calls