fix+docs+release(v0.4.4): D78 — olp-connect stale strings + CDN-safe README URL + pre-publish audit (#49)

* fix+docs+release(v0.4.4): D78 — olp-connect stale strings + README CDN-safe tag URL + repo public-flip pre-audit

Patch release on top of v0.4.3. Three small issues caught when running
olp-connect for real on MacBook (D77 client-install verification):

## G11: repo visibility flip

Repo dtzp555-max/olp flipped PRIVATE -> PUBLIC during this session.
Closes the original G11 finding (anonymous curl can't fetch raw URL from
private repos). Pre-publish audit (per cc-rules pre-publish-audit.md
checklist):
- Identity scrub: 0 hits — no taodeng, no 老大, no /Users/.../ paths,
  no personal hostnames, no personal emails, no real LAN IPs (only RFC
  documentation placeholders 192.168.1.10 + 10.0.0.5)
- Credential scrub: gitleaks 'no leaks found' — all olp_ matches are
  placeholder (olp_XXXX...) or test fixtures (olp_not-a-real-key-...)
- Git history: maintainer accepted Option A (GitHub-account email already
  verified-public on profile; flip exposes nothing new)

## G11 mitigation: README curl URL CDN-cache-safe

GitHub raw CDN serves a stale 404 for /main/<file> for ~5-15min after a
private->public visibility flip (negative-cache TTL). Tag-pinned URLs
bypass this because the tag ref was never queried while private.

D78 makes README's primary olp-connect curl URL tag-pinned:
  bash <(curl -fsSL .../v0.4.4/bin/olp-connect) <ip>
with /main/ listed as alternative for trusted-head users.

## G12: detect_openclaw claimed plugin not shipped

bin/olp-connect's OpenClaw detection block said "The OpenClaw OLP plugin
(D71-D73) is NOT YET SHIPPED" — but D71-D73 shipped olp-plugin/ at
v0.4.0. Replaces stale text with real install instructions:

  git clone https://github.com/dtzp555-max/olp.git /tmp/olp-repo
  openclaw plugins install /tmp/olp-repo/olp-plugin
  # or symlink: ln -sf .../olp-plugin ~/.openclaw/extensions/olp

Points at docs/integrations/openclaw.md for the full setup with
dedicated bot apiKey + restart-gateway notes.

## G13: olp-connect self-version hardcoded literal

Pre-D78 the script declared OLP_CONNECT_VERSION="0.4.0-phase4" as a
hardcoded literal that nobody updated through v0.4.1 / v0.4.2 / v0.4.3.
D78 derives the version at runtime from sibling package.json via
python3. When invoked from a checked-out repo, version resolves to the
actual value; when curl-piped (no on-disk package.json next to script),
falls back to "unknown".

  bash bin/olp-connect --version  # -> olp-connect 0.4.4 (automatic)

## Test count

717 (v0.4.3) -> 720 (v0.4.4). +3 D78 regression tests in Suite 36:
- 36v: pins absence of NOT YET SHIPPED text + presence of real install path
- 36w: pins runtime version derivation from package.json
- 36x: pins README tag-pinned URL recommendation

## Authority

- D77 MacBook client-install verification session (2026-05-26)
- ~/.cc-rules/docs/guides/pre-publish-audit.md (the checklist that
  preceded the visibility flip)
- Process learning: every README that includes a `curl raw-URL | bash`
  install pattern should pin to a release tag (not /main/) for CDN-
  cache resilience.

## Out of D78 scope (deferred)

- F6 (doctor client-side limitation) — Phase 5 ADR amendment
- D75 reviewer P2-1 (ADR 0004 per-hop schema) + P2-2 (defensive type
  assert) — non-blocking
- scripts/migrate-from-ocp.mjs — Phase 7

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix: D78 reviewer P2 fold-in — _resolve_version defensive guards (require /bin suffix + env-var path passthrough + nounset default)

---------

Co-authored-by: dtzp555 <dtzp555@gmail.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

test-features.mjs

@@ -15398,4 +15398,45 @@ describe('Suite 36 — D74 v0.4.1 hotfix regression (maintainer review findings)
     assert.ok(/anonymous_key_advertised_with_lan_bind/.test(adrSrc),
       'amendment must cite the startup-warn event name');
   });
+
+  // ── D78 v0.4.4: G12 stale openclaw text + G13 self-version derived ──────
+  it('36v (G12) — olp-connect openclaw detection no longer claims plugin not shipped', () => {
+    // D71-D73 shipped olp-plugin/. Pre-D78 the script said "NOT YET SHIPPED"
+    // which misled MacBook client testing on 2026-05-26. Pin the corrected text.
+    const ocSrc = _readFileSyncS36(_joinS36(import.meta.dirname ?? process.cwd(), 'bin/olp-connect'), 'utf8');
+    assert.ok(!/NOT YET SHIPPED/.test(ocSrc),
+      'olp-connect must NOT claim openclaw plugin is unshipped (D71-D73 shipped it at v0.4.0)');
+    assert.ok(/openclaw plugins install/.test(ocSrc) || /\.openclaw\/extensions\/olp/.test(ocSrc),
+      'olp-connect openclaw detection must give a real install path');
+    assert.ok(/docs\/integrations\/openclaw\.md/.test(ocSrc),
+      'olp-connect must point at the openclaw integration doc');
+  });
+
+  it('36w (G13) — olp-connect self-version derived from package.json (not hardcoded)', () => {
+    // Pre-D78 OLP_CONNECT_VERSION was a hardcoded literal "0.4.0-phase4" that
+    // nobody updated across v0.4.1/v0.4.2/v0.4.3. D78 derives at runtime
+    // from sibling package.json so the literal stays in sync automatically.
+    const ocSrc = _readFileSyncS36(_joinS36(import.meta.dirname ?? process.cwd(), 'bin/olp-connect'), 'utf8');
+    // The old hardcoded literal must be gone
+    assert.ok(!/OLP_CONNECT_VERSION="0\.4\.0-phase4"/.test(ocSrc),
+      'hardcoded "0.4.0-phase4" version literal must be gone');
+    // The new derivation logic must reference package.json
+    assert.ok(/package\.json/.test(ocSrc) && /OLP_CONNECT_VERSION=/.test(ocSrc),
+      'OLP_CONNECT_VERSION must derive from package.json');
+  });
+
+  it('36x (D78) — README pins primary olp-connect curl URL to a release tag (CDN-cache-safe)', () => {
+    // G11 root cause: README's `bash <(curl ... /main/bin/olp-connect)` got
+    // bitten by GitHub raw CDN's negative-cache TTL when the repo flipped
+    // private->public. Tag-pinned URLs (.../<tag>/bin/...) bypass that
+    // negative cache because the tag ref was never queried while private.
+    // D78: README presents the tag-pinned URL as the primary recommendation,
+    // with /main/ as an alternative for trusted-head users.
+    const readmePath = _joinS36(import.meta.dirname ?? process.cwd(), 'README.md');
+    const readmeSrc = _readFileSyncS36(readmePath, 'utf8');
+    assert.ok(/raw\.githubusercontent\.com\/dtzp555-max\/olp\/v\d+\.\d+\.\d+\/bin\/olp-connect/.test(readmeSrc),
+      'README must include a release-tag-pinned olp-connect URL (e.g., /v0.4.4/bin/olp-connect)');
+    assert.ok(/Pinned to a known-good release/.test(readmeSrc),
+      'README must explain why the tag-pinned form is the primary recommendation');
+  });
 });