video-to-gif v0.2.0

Opt-in remote source acquisition: video-to-gif can now download a source from a
remote http/https URL before converting it locally. The capability is
disabled by default and gated by explicit enablement/approval; conversion
itself stays local and network-isolated, and all remote access is download-only.

Added

• Opt-in remote HTTP/HTTPS source acquisition (spec FR-018..023): a URL may be
  supplied wherever a source is accepted (--input or a manifest input field),
  downloaded into a secure temporary directory and handed to the existing local
  pipeline as untrusted local media.
• Remote CLI flags: --allow-remote (enable acquisition for one run),
  --keep-remote-source (retain the download and report its path),
  --remote-adapter ytdlp (acquire a video-page URL through the optional,
  never-bundled yt-dlp adapter), --allow-insecure-http (acknowledge an
  unencrypted http transfer), and --allow-remote-address (approve a specific
  private/loopback address for the SSRF check; repeatable).
• Configuration: remoteSources (disabled (default) / ask / enabled),
  keepRemoteSource, and download limits limits.maxDownloadBytes
  (default 2 GiB) and limits.maxDownloadSeconds (default 900 s).
• Download progress emitted on stderr under stage download (bytes received
  and, when the total size is known, a percentage).
• Exit code 14 (REMOTE_DOWNLOAD_FAILED) for a network error, HTTP error
  status, or truncated/timed-out remote download.
• doctor yt-dlp reporting: doctor now reports whether the optional yt-dlp
  adapter is available and, when present, its version. Its absence is never a
  failure.

Changed

• A URL supplied under the default configuration now returns REMOTE_DISABLED
  (status remote_disabled, exit 8) and performs no network access. In 0.1.0 the
  same situation returned UNSUPPORTED_REMOTE_SOURCE; that remains the documented
  behavior of the 0.1.0 product.

Security

• SEC-012 — Remote source network boundary. Only the acquisition component is
  network-capable; inspection/palette/encode stay network-isolated under SEC-010,
  and a downloaded file is treated as untrusted local media.
• SEC-013 — URL scheme allowlist. https always; http only with an explicit
  unencrypted-transfer warning; file and every other scheme rejected as
  UNSUPPORTED_URL_SCHEME (exit 5), enforced before any connection and on every
  redirect.
• SEC-014 — Private-network / SSRF protection and connection pinning. Loopback,
  private, link-local/unique-local, and cloud-metadata addresses are blocked as
  PRIVATE_NETWORK_BLOCKED (exit 8) unless explicitly approved; the direct path
  resolves the host, validates every address, and pins the connection to the
  validated address (DNS-rebinding resistant), re-checking every redirect.
• SEC-015 — Credential and token redaction. Any URL echoed anywhere is reduced
  to scheme/host/path; signed-URL query strings and userinfo are stripped and
  never stored in configuration or manifests.
• SEC-016 — Download hardening. Size ceiling enforced on bytes actually
  received, wall-clock timeout, and a free-disk pre-check; partial downloads are
  always removed.
• SEC-017 — DRM and access-control integrity. DRM-protected/access-controlled
  sources are rejected as DRM_PROTECTED (exit 5); no circumvention is attempted.
• yt-dlp adapter residual risk. The optional yt-dlp adapter performs its own
  DNS resolution, connection, and redirect-following that the engine cannot pin.
  Its scheme, DRM, and SSRF host checks are enforced best-effort before launch
  but do not carry the direct path's connection-pinning guarantee; a
  TOCTOU/rebinding change or a redirect yt-dlp follows to a private address is not
  guaranteed to be blocked (accepted residual risk, documented per SEC-014).

Fixed

• Marketplace files moved to the repository root (.claude-plugin/marketplace.json
  and .agents/plugins/marketplace.json, previously under marketplaces/).
  claude plugin marketplace add owner/repo resolves the marketplace manifest at
  the repository root, so the nested layout made the plugin uninstallable from
  the repo. Plugin source paths now correctly resolve to ./packages/... from
  the root.