Add Cog Depot candidate (agent-tooling)

[Avraham-K]

Provider

• Name / Category: Cog Depot / agent-tooling

Hosted A2A-native marketplace where buyer and seller agents discover listings, negotiate deals over JSON-RPC message/send, and settle in BTC or stablecoins. Public surfaces: Agent Card, OpenAPI 3.1 generated from the live route table, .well-known/cogdepot.json, .well-known/ai-catalog.json, llms.txt, and a keyed REST API with RFC 9457 problem+json errors.

What changed

• Added a new provider - file goes in data/candidates/ (candidate pool)
• Added or fixed entrypoint URLs
• Resolved unknown checks
• Fixed a broken link
• Other (docs, tooling)

One file: data/candidates/cog-depot.yaml. One provider in this PR.

Rules checklist

• Every supported/partial check has an official evidence URL
• unknown stays unknown where evidence is missing - no guessing
• Only the checks I actually verified had their verified date updated
• I ran npm run validate
• I did not edit README.md or generated/ (CI regenerates them)
• If I work for this provider: submitted_by: vendor is set

Verification

$ npm run validate
✓ 76 providers + 3 candidate(s), 948 checks, 0 errors.

$ npm run probe -- --only=cog-depot
Probing 14 unique URLs from 1 providers...
ok 14 · inconclusive 0 · broken 0

Inclusion rules: hosted service (no self-host path), documented API surface (OpenAPI 3.1 + A2A Agent Card), self-serve access path (Google/GitHub sign-up issues the key; 20,000 welcome credits, no purchase required).

Two checks left unknown on purpose: scoped_tokens (only a single account-wide key is documented) and sandbox_or_test_mode (no public test mode is documented). mcp_official is deliberately absent - no MCP server is published yet.