[yummybomb]

Summary

Adds page-kind eBay marketplace tools: search, get_listing, and get_seller_profile. Search supports sold/completed filters in an already signed-in browser and warns that sold Best Offer prices may differ from accepted prices.

The updated sources validate input before interaction, support cancellation, return typed response-body/redirect failures, refuse verification-page invocations, bound returned text, redact recognized postal destinations, and return only canonical public image URLs from exact allowed hosts. Redirect follow-ups remain restricted to the same origin; request-chain costs and limitations are documented.

All tools are read-only. No cart/watchlist mutations, bids, offers, purchases, messages, onboarding or seller publishing are exposed. Cart and account-list access was unavailable behind contact-information/verification gates; populated data and action contracts were not guessed. Consequential execution is omitted because the runtime has no trusted exact-action human approval enforcement.

Tests

• node scripts/validate-registry.mjs: 82 tools valid.
• node --test "tests/*.test.mjs": 1644 passed, 0 failed; 67 eBay fixture tests.
• node --test "extension/**/*.test.mjs": 14 passed.
• Existing unrelated registry entries are unchanged; no shared runtime or lockfile edits.
• Historical builder Kernel checks on 9f8f3bb: whole-namespace registration, sold-search success in an authorized session, and signed-out verification-page failures. No account mutations. Signed-in sold-only was not repeated on final source.
• Initial independent review at 9f8f3bb found empty-key validation bypass and untyped malformed-variation errors; both were fixed at 5cda1c1. First recheck signed off search/seller but found one nested listing-price coercion error. It was reproduced and fixed, including analogous shipping/currency paths, at 0c0688f. Final allowed recheck signed off all three tools on that source; registry statuses are qa_passed, not verified. Final commit only records QA metadata/docs and leaves reviewed tool sources byte-identical.
• Initial updated-source runtime review: Kernel real search hit a challenge; extension real search succeeded, then listing hit a challenge. Remaining success/failure checks were emulated and labeled separately. First recheck at 5cda1c1 made exactly three real Kernel reads, all successful; extension checks were entirely emulated. Final-source recheck: one real Kernel listing read succeeded; 25 runtime outputs passed Ajv (one real success, 20 emulated outcomes, four no-request guards). Extension was entirely emulated. Namespace replacement and five cancellation phases per runtime passed; no all-tool real-success parity is claimed.

Limitations

Account/cart/watchlist contracts are unavailable; final-source signed-in sold-only, wrong-account behavior and real non-US coverage remain untested. Bids/offers/purchases/publishing require manual handoff and are not executable. Unknown verification markup fails as site_changed. See the domain README for output semantics, retry costs and evidence boundaries.

This PR remains a draft; no auto-merge.