v1.3.0 — Phase 0 runs with zero secrets (free keyless Exa MCP rung)

The hosted Exa MCP server (https://mcp.exa.ai/mcp) serves rate-limited search with no API key — Exa's documented "Keyless" mode, verified live against the real endpoint (real BBL results returned; the recorded response is now the parser's unit-test fixture).

Added

• exa-mcp-keyless rung in run_daily.py's Phase 0 ladder: exa-mcp → exa-mcp-keyless → tinyfish. Paid Exa outranks keyless (same provider, better limits — serving twice would duplicate rows); TinyFish stays last as the independent index.
• The Phase 0 preflight now passes with zero secrets — the daily runtime works on a fresh fork on day one.
• Registry surface search:exa-mcp-keyless in the rehearsal; transport parser pinned against the recorded live SSE response; 429 rate limits land in the run's failure detail, never silent.

Fixed

• --offline in rehearse.py derived its check set from an empty env tuple, so the keyless (network!) check would have been probed in the mode that promises not to touch the network. "Structural" is now a declared property of Check; env-free no longer implies offline.

Verification

• pytest 1617 passed · product graders ✅ · do-harness verify --strict ✅ · live smoke: 5 candidates from the keyless rung

🤖 Generated with Codebuff
Co-Authored-By: Codebuff noreply@codebuff.com