Prepare Scrapling For Deploy

What the helper does:

• derives the allowed host from the canonical public base URL,
• writes the fail-closed scope descriptor under .shuma/scrapling/,
• writes the minimal seed inventory under .shuma/scrapling/,
• keeps the default seed to the normalized public root URL only,
• records the local and remote ADVERSARY_SIM_SCRAPLING_* env contract,
• records deployment-egress notes and verification commands in the durable receipt.

What the helper must not do:

• it must not ask the operator for a route catalog or sitemap for the normal case,
• it must not treat GATEWAY_SURFACE_CATALOG_PATH as the Scrapling reachable-surface map,
• it must not add extra seeds or robots.txt hints by default,
• it must not imply that edge deploy alone makes the full Scrapling runtime operational.

Shared-Host Rule

For ssh_systemd shared-host targets, this helper is part of the supported full runtime path.

Important:

• ../deploy-shuma-on-linode/SKILL.md already runs this automatically.
• Do not send the operator through a second manual scope/seed workflow if the Linode deploy helper can infer the artifacts from the final public domain.
• make remote-update must preserve the same receipt-driven scope/seed contract later.

Edge Boundary

For external_supervisor or Fermyon/Akamai discussions:

• the helper can still express the minimal artifact contract,
• but the resulting receipt is boundary truth only, not proof of a supported full hosted worker runtime.

If the operator wants the real Scrapling adversary runtime today, route them to the shared-host deploy path instead of stretching the edge deploy skills past their current contract.

Reality Rule

Telemetry is the map.

That means:

• deploy-time scope and seed artifacts only define the initial allowed starting envelope,
• the reachable surface must come from later traversal telemetry,
• a precompiled deploy-time catalog must not be presented as runtime surface truth.