feat(research): add React Native contract providers

[brentvatne]

Summary

• add fixed research providers for React, Flow, TypeScript, web standards, Chrome DevTools Protocol, Android NDK, CMake, and CocoaPods
• add a standard provenance class while preserving the existing default provider fan-out
• extend the allowlist, direct-fetch and scoped-discovery adapters, MCP metadata, documentation, and recorded-corpus coverage
• correct the README's stale description of research-cache behavior

Security boundary

• exact HTTPS host and path allowlists
• search results remain discovery-only; fetched official bodies are evidence
• React Native PR and issue history remains outside the runtime endpoint
• Hermes main is intentionally excluded because it may not match React Native's vendored revision

Validation

• bun test — 721 passed
• bun run typecheck
• bun run lint
• bun run fmt:check
• bun run llp:check
• bun run build && node scripts/research/evaluate-corpora.mjs — 25/25

[github-actions]

🤖 AI code review

Decision: Ready for human review

Overall PR risk: Low. Change is additive — adds eight fixed research providers (React, Flow, TypeScript, web standards, Chrome DevTools Protocol, Android NDK, CMake, CocoaPods) with a new "standard" provenance class. Existing research behavior remains unchanged; the change only extends provider entries, allowlists, and adapters. Blast radius is bounded to the research MCP when research.enabled is true, with straightforward rollback by reverting the new provider entries.

🔗 Review setup:

• This PR changes code the reviewer prompts cite (src, src/tests). Check that the guidance quoting it is still correct.

No findings.

---

This review is advisory — it never blocks a merge and never auto-approves.