feat: add standout connector

[andrei-hasna]

Summary

• Add @hasna/connect-standout package under connectors/standout/ with bearer-auth REST client for https://api.standout.ai/v1
• Implement API methods: listCandidates, getCandidate, listRoles, createAssessment, listAssessments, rawRequest
• Wire Commander CLI (profile/config, candidates, roles, assessments, raw) and register connector in Business Tools

Test plan

• cd connectors/standout && bun install && bun run typecheck && bun test src/api/client.test.ts (6 pass)
• Root bun run typecheck
• Root bun run build
• Root bun test (1192 pass; 1 pre-existing unrelated failure in CLI events/webhooks isolated-store test)
• Security scan: no beepmedia/hasnaxyz/alumia/browser-use references in connector package

[andrei-hasna]

Worker validation for task 26bf19a1-a057-4409-984c-f424c114d3e6: do not merge as-is.

Blockers:

• Local merge of origin/pr/289 into current origin/main conflicts in src/lib/connectors/business-tools.ts. origin/main...origin/pr/289 shows main is 304 commits ahead and PR is 1 commit ahead. Conflict is around the Business Tools registry insertion; resolution should keep the new main entries and add standout in the correct location.
• connectors/standout/package.json advertises ./dist/index.d.ts, but the package build script only runs bun build; Bun does not emit declarations. Add a declaration emit step such as tsc --emitDeclarationOnly before publishing/merging.
• connectors/standout/src/utils/config.ts writes profile JSON containing API keys without explicit private permissions (0o600). Please harden credential file writes.

Validation performed:

• GitHub CI check build: passing.
• PR is open, non-draft; no reviews/comments before this worker pass.
• bun test connectors/standout/src/api/client.test.ts: 6 pass, 0 fail.
• Security grep found no browser-use/browseruse, no banned internal beepmedia/hasnaxyz, and no hardcoded live secret pattern in the added connector.
• cd connectors/standout && bun run typecheck could not run in this isolated worktree because dependencies are not installed (tsc: command not found), and bun install is blocked by sandbox tempdir writes (ReadOnlyFileSystem).

Adversarial reviewer recommendation also says not to merge as-is due to the conflict plus declaration/credential-storage issues.