chore: promote runtime surface deriv@1.0.0

[vaibhavkumar-deriv]

Promotes the runtime surface from the private working repo at 0b35ccb. This is the first public production surface: identity deriv at 1.0.0, the production hosted MCP URL, and bundled Agent Skills as the MCP-down fallback.

The tree was assembled by the promotion build from a copy-by-inclusion allowlist — not by hand — and every file here reconciles exactly to that allowlist.

Changes

• Identity — deriv @ 1.0.0 in lockstep across the four manifests and the three marketplace indexes, replacing deriv-api @ 2.0.2. (Beta) listing copy is gone.
• MCP — .mcp.json now points at https://mcp-api-v2.deriv.com/mcp, replacing the staging Cloud Run URL. One remote server, keys type and url only: no command, args, cwd, env or headers, and no root mcp.json.
• Skills — adds skills/ (deriv-auth, deriv-market-data, deriv-trade-types, deriv-trade-lifecycle, deriv-trading-app, deriv-llms) as the fallback an agent reads when the hosted MCP is unreachable. Cursor and Codex declare "skills": "./skills/"; Claude Code discovers skills/ at the plugin root.
• Assets — the listing logo is now the coral icon PNG pair. The previous wordmark assets/logo.svg and assets/logo-dark.svg are deleted: no manifest or marketplace entry references an SVG, and the promotion build is copy-by-inclusion, so a file dropped from the allowlist has to be removed explicitly rather than lingering.
• Docs — README.md is rewritten as a standalone partner plugin guide: native plugin install first, then a skills-only path for agents that support only the Agent Skills standard, a skills catalog, and the MCP table. CONTRIBUTING.md, SECURITY.md and PRIVACY.md follow the new name and drop internal architecture prose while keeping their disclosures intact.
• CI — .github/workflows/verify-surface.mjs is updated in step with the surface it checks. This is deliberate and load-bearing: the previous copy pinned deriv-api, the two SVGs, and "this plugin has no skills/ tree", so promoting the surface without it would turn this repo's own CI red immediately.

Verification

Run against this branch before opening:

• verify-surface.mjs on the branch: OK, surface plus content and internal-reference gates clean.
• The staged tree reconciles exactly to the promotion allowlist — no allowlisted path missing, no staged path unlisted.
• All five content gates report zero matches (internal hostnames/repo names, secrets, tooling artefacts, local-runtime remnants, internal references). Seven planted leak classes were each rejected, so the gates are live rather than merely quiet.
• .cursor-plugin/plugin.json and .cursor-plugin/marketplace.json validate against Cursor's published schemas fetched live from cursor/plugins, not only against vendored copies.
• Every bundled docs page is byte-identical to its published counterpart on developers.deriv.com, compared in full rather than sampled.
• Every relative link across skills/ resolves; each SKILL.md frontmatter name matches its directory and carries the MCP-first preamble and the do-not-invent-fields clause.
• The hosted MCP answers a live handshake with application/json, and every bare tool name cited anywhere in this surface exists on it. No host-namespaced tool name appears in any prose, since those differ per host.
• No count of hosted tools or of the live API surface is written into prose anywhere.

Notes for reviewers

• Breaking for existing installs. Anyone installed as deriv-api@deriv-api-marketplace should uninstall it before installing deriv@deriv; leaving both is a silent override where the new plugin does not load and no error is shown.
• Cursor install is clone-only for individual users. Cursor's own marketplace/URL import is Teams and Enterprise only.
• No marketplace submission is part of this. This populates the public surface; any listing is separate.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details

Scanned Manifest Files

[ako-deriv]

Reconciled this branch against the private working repo at 0b35ccb:

• Ran build-promotion-bundle.mjs from that commit and diffed the staged tree against this branch. Byte-identical: same file list, no content differences.
• Nothing outside the promotion allowlist is present. .github/ carries only the four scaffold files the build stages deliberately.
• Against public master, the only deletions are assets/logo.svg and assets/logo-dark.svg, matching the allowlist's move to the PNG pair.
• verify-surface.mjs passes locally on the branch, and all five CI checks are green.

Public master will be in step with the working repo for the first time once this lands. Approving.