Integrations: bind and enforce the unpublished external-web-v1 profile #27

The site automatic-authorization work in CompleteTech-LLC/complete.tech#17 and #59 needs a maintained integration profile after lifecycle PR #25. Existing r2-header-v1 remains unchanged and scanning stays disabled by default.

Acceptance:

• Pin canonical external-web-v1 manifest bytes and explicit selected HTTP/80 and HTTPS/443 services in accepted evidence, job claims, durable recovery and result callbacks.
• Execute only the reviewed robots, public-root header/version triage, security-header presence and verified TLS observations using the maintained passive Checker; retain typed bounded observations and an explicit unassessed manual remainder.
• Share one admitted transport and cumulative meter across services, redirects and checks; enforce safe DNS/address pinning, Host/SNI, one connection, pacing, response/framing/decompression limits, time and aggregate budgets without restart or retry resets.
• Bind WordPress persistence, schema, admission compare-and-set and typed result validation to the frozen profile and exact expiry; reject partial, changed, legacy-to-new or new-to-legacy bindings.
• Preserve legacy payloads and strict target/control/recipient/report/retention safeguards. No activation, public/customer probes or inferred customer consent.
• Add meaningful pure component and real-component synthetic regressions, then controlled disconnected-network and protected disposable WordPress/database acceptance evidence. Require exact-head CI and two new independent reviews of the final current-main candidate before merge.

This issue tracks source work only. Production deployment/adoption, actual publication date and next unused agreement revision, customer authorization and operational activation remain separate verified prerequisites. The candidate is dependent on PR #25; implementation tests are not evidence of customer or production outcomes.