fix(boss): restore read-only job search and detail

[baigao417]

What changed

• Restores boss search against the current /web/geek/jobs page by capturing the page's own joblist.json response.
• Restores boss detail against the fully rendered current job-detail page instead of the retired detail API.
• Keeps both commands explicitly read-only; this PR does not add or invoke greeting, messaging, upload, application, or other account-write actions.
• Makes opencli adapter eject boss self-contained by keeping the auth helper inside the BOSS adapter directory.
• Hardens parameters, typed auth/empty failures, listing-to-detail IDs, and the detail row shape.
• Adds a sanitized live-page DOM fixture and reverse-validated selector regression test.

Strategy notes

boss search

• Strategy: INTERCEPT
• Contract: internal-unstable
• Observed request: the current jobs page issues joblist.json and returns zpData.jobList with encryptJobId.
• Auth source: the user's existing logged-in Chrome session; no credentials are copied or persisted by the adapter.
• Replay result: live browser verify returned non-empty jobs and round-trippable security_id values.
• Why not direct COOKIE/PAGE fetch: the previous direct endpoint path is no longer reliable, while letting the page issue its normal request works with the site's current runtime checks.
• Maintenance tradeoff: isolated to a read-only listing command and guarded by typed errors plus live verify.

boss detail

• Strategy: UI
• Contract: visible-ui
• Semantic anchors: .job-primary, .job-detail, .job-boss-info, .job-sider, and .company-address.
• Typed error path: incomplete rendered pages fail with CommandExecutionError; malformed IDs fail before navigation with ArgumentError.
• The 18 legacy top-level fields are preserved in 12 agent-native keys by grouping location, recruiter, and company metadata one level deep.

Safety boundary

• boss/search: access: read
• boss/detail: access: read
• No call path in these commands sends a greeting/message, uploads a resume, applies to a job, or mutates account state.
• Live verification used only search and detail reads.

Verification

• npm run build — pass, 1331 manifest entries.
• npm run typecheck — pass.
• BOSS focused suite — 6 files / 46 tests pass.
• npm run check:typed-error-lint — pass, 0 new violations.
• npm run check:silent-column-drop — pass, 0 new violations.
• opencli adapter eject boss + opencli validate boss — pass, 16 commands / 0 errors / 0 warnings.
• opencli browser ... verify boss/search — pass against a live logged-in browser and generated fixture.
• opencli browser ... verify boss/detail — pass against a live logged-in browser; 1 row, row-shape gate pass.
• npm pack --dry-run --ignore-scripts --json — pass; BOSS source, tests, fixture, and local auth helper are included.

The complete Windows suite still has unrelated upstream path/network failures outside BOSS. The same origin/main baseline reproduces 17 failures; this branch reports 18 in one run due an additional nondeterministic plugin-directory race. No BOSS test fails. Linux CI remains the authoritative full-suite gate.

Release note

The current source and npm latest remain 1.8.6; this PR intentionally does not pretend that a new package has been published. After merge, the next maintainer release should include these adapters and validate the installed package with the commands listed above.

[baigao417]

CI is currently waiting on the upstream fork-workflow approval gate: CI, Security Audit, and Doc Check all report action_required with zero jobs for commit de81af7d. The PR is mergeable and the focused/local/live checks are documented above. A maintainer needs to approve the fork workflows before GitHub can run the authoritative checks.