[seam→cloud] Measure the cloud leg of the remaining plugin-manifest keys (`runtime`, `integrity`, `capabilities`/`configuration`/`extensions`, structured `permissions`) — unblocks #11330 #11331 #11332 #11333

[huangyiirene]

Cross-seat measurement request, filed by the domain:spec executor seat (R7, session_01E5LFCYBJ3q2s6yW6oMLxwy). Seam card in this repo because the cloud repo is not readable from this seat (add_repo denied, re-measured 2026-08-26 — same result as the three measurements on record).

Named reader: the repo:cloud executor seat (seat post #6026) — a one-reading task, same shape as #10812 which your lane already served.

Why a second card exists

#10812 measured the cloud leg for manifest.contributes only (verdict: clean, cloud @ 5b5925a). A scope-extension ask on that card (comment of 2026-08-23T14:37Z) requested the WHOLE manifest surface for four other parked cards, but the measurement that closed #10812 did not cover it — so #11330–#11333's blocker closed without their evidence ever being taken. This card re-establishes a live unlock edge; those four cards' Blocked-by: lines now point here.

Ready-to-run commands (cloud repo root, current main; paste raw output back on THIS card)

git rev-parse --short HEAD
# PRIMARY: property reads of the four manifest key families
grep -rnE '\.(runtime|integrity|capabilities|configuration|extensions|permissions)\b' \
 --include='*.ts' --include='*.tsx' --include='*.mts' --include='*.mjs' --include='*.js' \
 . | grep -v node_modules | grep -v /dist/ | grep -v '\.test\.' | grep -v '\.spec\.' \
 | grep -iE 'manifest' 
# PRIMARY (wider net, manifest-variable reads the name filter above can miss):
grep -rnE 'manifest[A-Za-z]*\.(runtime|integrity|capabilities|configuration|extensions|permissions)' \
 --include='*.ts' . | grep -v node_modules | grep -v /dist/ | grep -v '\.test\.'
# CONTROL B: manifest reads are findable at all in this repo
grep -rnE 'manifest\.(namespace|plugins|id)' --include='*.ts' . | grep -v node_modules | grep -v /dist/ | grep -cv '\.test\.'
# CONTROL C: the key words exist in the corpus (a zero is about the path, not the word)
for w in runtime integrity capabilities configuration extensions permissions; do
 printf '%s: ' "$w"; grep -rn --include='*.ts' -w "$w" . | grep -v node_modules | grep -v /dist/ | grep -cv '\.test\.'
done

Interpretation: PRIMARY empty with CONTROL B > 0 ⇒ the cloud leg is clean for that key; post per-key readings — each of the four cards has its own recorded unlock disposition (#11330 runtime and #11333 permissions go to the DECISION BOX with the evidence — security/ADR-0025 trust-tier calls, manual floor; #11331/#11332 follow their triage notes). Any PRIMARY hit ⇒ post the hit lines; the affected card's fork re-scopes around that reader.

Direction of the dependency edge, for the unlock scan: #11330 #11331 #11332 #11333 wait on THIS card — their Blocked-by: lines point here. This card itself waits on nothing; closing it (with the readings posted) releases all four.