feat: complete CRM cleanup write loop

[SQbal1]

Summary

• read the current CRM record at runtime through native web.fetch with a caller-supplied host allowlist
• extract schema-keyed candidates from ordinary call-transcript prose through one bounded agent task
• deterministically require exact evidence quotes, declared fields, scalar values, type/enum/range conformance, and one unambiguous value per field
• route hedged, conflicting, malformed, out-of-schema, and actionable-but-unmappable prose to needs_review with zero writes
• consume only ready plans through a separate atomic mock-CRM transport and seal source provenance plus exact before/after evidence
• retain an explicit no-action path whose transport performs zero writes and whose before/after records are identical

The mock transport is deliberate: it proves the complete runtime source-read and separately consumed write loop without requiring production CRM credentials. Harnesses bind deterministic HTTP responses; post-publish dogfood reads the public connector URL through the native network effect.

Validation

• node --check skills/crm-cleanup/crm-cleanup.mjs
• released @runxhq/cli 0.8.2 skill inspect: ready and fully bound
• released @runxhq/cli 0.8.2 harness: 9 cases, 0 assertion errors
• current-source runx-cli 0.8.2 inspect: ready and fully bound
• current-source runx-cli 0.8.2 harness: 9 cases, 0 assertion errors
• natural happy path: 3 schema-keyed changes, 1 atomic mock write
• natural no-op plus hedged, conflicting, and unmappable paths: 0 writes
• git diff --check -- skills/crm-cleanup
• package secret-pattern scan: no findings
• commits carry DCO sign-off