Add jsr.io to deno network profile allowed domains

[Mossaka]

Problem

The deno runtime profile in the network firewall allowlist is missing jsr.io domains. JSR (JavaScript Registry) is Deno's modern package registry and is required for most contemporary Deno projects.

Current Behavior

When running agentic workflows with deno runtime and firewall enabled, Deno cannot download dependencies from JSR:

error: JSR package manifest for '@std/assert' failed to load. 
Import 'https://jsr.io/@std/assert/meta.json' failed.

The firewall returns HTTP 403 because jsr.io is not in the allowed domains.

Root Cause

In pkg/workflow/domains.go, the deno runtime maps to the "node" ecosystem:

var runtimeToEcosystem = map[string]string{
    // ...
    "deno": "node",   // deno.land is in the node ecosystem
}

The node ecosystem in pkg/workflow/data/ecosystem_domains.json includes deno.land but not jsr.io:

"node": [
  "npmjs.org",
  // ...
  "deno.land",
  // jsr.io is missing
]

Proposed Solution

Add JSR domains to the node ecosystem (since deno shares it) or create a separate deno ecosystem:

"jsr.io",
"*.jsr.io"

Testing

Tested with these Deno projects:

• denoland/std - Deno standard library (uses @std/* from JSR)
• oakserver/oak - Oak web framework (uses @oak/* and @std/* from JSR)

Both failed to run tests because JSR dependencies couldn't be resolved.

Related

• JSR documentation: https://jsr.io/docs
• JSR is the recommended registry for Deno packages as of Deno 1.x+