Harden portable provider authority and research evidence

[ga1ien]

What changed

• releases @braintied/research 0.8.4 on top of the merged resumable 0.8.2 runtime
• resolves provider configuration from one absolute, owner-only, allowlisted environment source
• rejects conflicting aliases, inherited Node env-file preloads, symlinks, and generic fallback ambiguity
• validates Gemini quotes and claims against fetched parent sources before synthesis
• adds bounded, redirect-safe public HTTP transport and secret-safe logging
• hardens Reddit, retry cancellation, pipeline evidence, and source handling

Why

The resumable client fixed transport-loss duplication, but a follow-up root audit found that workspace-specific environment paths and model-selected evidence could still fail ambiguously or admit unsupported claims.

Impact

All agents can use the same portable research package without copying secrets into each workspace. Evidence is source-bound and network retrieval is bounded before output is accepted.

Validation

• npm run typecheck
• npm test — 103 unit tests and 8 Instagram provider tests
• npm pack --dry-run --json — 15 reviewed entries, 804,356 bytes
• local pre-push CI repeated typecheck, tests, and build