Improve Pyrimid seed paid endpoint outputs

[MalyisGreat]

Summary

• Expands vendor-lead-discovery from generic placeholder rows into segment-specific lead scoring with live GitHub repository discovery, ranking, evidence, and Pyrimid catalog metadata hints.
• Expands mcp-server-audit into actionable audit JSON with URL normalization, GitHub repo inspection, MCP metadata probing, paid-tool recommendations, x402 402 route shape, catalog metadata, risk notes, and integration steps.
• Adds catalog output_schema coverage for both paid products so buyer agents can inspect the richer response shapes before purchase.
• Keeps deterministic fallback profiles when live discovery is rate-limited or unavailable.

Bounty References

• MonetizeYourAgent job 25: Pyrimid bounty: improve vendor-lead-discovery output ($20 USDC).
• MonetizeYourAgent job 26: Pyrimid bounty: improve mcp-server-audit output ($20 USDC).

Public Base USDC payout address if accepted: 0x85FDDaCFB64b6486094B45bA9a235e674a590497

Verification

npm run build
git diff --check

Additional local route checks after the latest commit:

• Verified /api/v1/catalog?query=vendor-lead-discovery&limit=1 includes required fields for the enriched lead-discovery output schema.
• Verified /api/v1/catalog?query=mcp-server-audit&limit=1 includes required fields for audit inspection and recommended paid-tool schemas.
• Verified /api/v1/paid/mcp-server-audit?url=github.com/pyrimid-ai/pyrimid still returns HTTP 402 with X-Pyrimid-Product: mcp-server-audit.

[MalyisGreat]

Updated the branch with a small hardening pass after review:

• mcp-server-audit now skips live URL probes for unsupported protocols, localhost/internal hostnames, and private/link-local IPs before fetching MCP metadata.
• Re-ran npm run build successfully on the branch.
• Re-ran git diff --check successfully.
• Updated public patch artifact: https://github.com/MalyisGreat/MalyAI/blob/main/bounty-submissions/pyrimid-mcp-audit-vendor-leads.patch

[MalyisGreat]

Updated the branch with one more bounded-failure hardening pass:

• Added timeouts around GitHub repository search/metadata fetches used by vendor-lead-discovery.
• Added timeouts around MCP metadata probes used by mcp-server-audit so slow target URLs do not hang the paid endpoint.
• Re-ran npm run build successfully.
• Re-ran git diff --check successfully.
• Refreshed public patch artifact: https://github.com/MalyisGreat/MalyAI/blob/main/bounty-submissions/pyrimid-mcp-audit-vendor-leads.patch

[MalyisGreat]

Follow-up hardening/update after comparing the open bounty PRs:

• Added catalog output_schema coverage for both improved products so buyer agents can see the richer paid response shape from /api/v1/catalog, not only after payment.
• Kept the previous live GitHub lead discovery, MCP target inspection, private/local URL probe guards, and fetch timeouts.
• Refreshed the public patch artifact: https://github.com/MalyisGreat/MalyAI/blob/main/bounty-submissions/pyrimid-mcp-audit-vendor-leads.patch

Verification rerun:

• git diff --check
• npm run build