feat(eosl): EOSL.ai hardware end-of-service-life plugin (DRAFT — do not merge)

[asachs01]

DRAFT — for review, do not merge; built overnight per Aaron's go.

What this adds

A new eosl plugin: hardware end-of-service-life (EOSL) lookups backed by the public EOSL.ai MCP — a free, read-only, no-auth streamable-HTTP service (https://eosl.ai/mcp). It's a data-source plugin that complements assets-pack (the cross-vendor RMM judgment layer) rather than duplicating it.

Skills (3)

Skill (canonical id)	What it does
eosl-lookup (skills/lookup/)	Single-part and product-family EOSL lookups — status, end-of-sale date, EOSL date, support-runway score, and the vendor-bulletin link. Covers the individual-part-lookup and product-family-search tools.
eosl-hardware-lifecycle-audit (skills/hardware-lifecycle-audit/)	Takes a supplied client inventory (list or CSV of part numbers/models), runs the bulk-check tool in batches of 200, classifies each item (past EOSL / approaching within a configurable window, default 12 months / supported / not-found), and emits a prioritized renewal/migration report with a vendor-bulletin URL per item.
eosl-psa-lifecycle-audit (skills/psa-lifecycle-audit/)	Advanced workflow scaffold: pull PSA configuration items → extract part/model → run the lifecycle audit → flag renewals. Wired concretely to the existing autotask (autotask-configuration-items skill) and connectwise-psa (connectwise-psa-lookup-config command) plugins. The PSA-pull is an explicit stub/TODO — no PSA API is hardcoded (see Assumptions).

Also included

• eosl/.mcp.json — bundled connector (mcpServers.eosl → https://eosl.ai/mcp), a single entry deliberately easy to swap or remove.
• eosl/.claude-plugin/plugin.json, eosl/README.md.
• A marketplace.json entry (eosl, category workflow-pack).
• A CHANGELOG.md entry under [Unreleased] › Added.

The plugin ships no agents or commands — it's a data-source plugin; the fleet-wide judgment layer already lives in assets-pack.

Required caveats (baked in, per instruction)

• Sends part numbers to a third party — each skill states that running it sends the looked-up part numbers/models to EOSL.ai, an external service.
• Public endpoint, not a WYRE endorsement — framed everywhere as "uses the public EOSL.ai endpoint"; the service is described as new and anonymously-operated, and the connector is one .mcp.json line so it's easy to swap or remove.
• Verify against the vendor bulletin — every skill requires attaching the "confirm the date against the linked vendor bulletin before any purchase/renewal/migration" caveat to any cited date.

Repo conventions matched

• Modeled on the existing assets-pack plugin (same domain) and the azure-mcp external-MCP plugin: .mcp.json at plugin root + .claude-plugin/plugin.json, skills/<slug>/SKILL.md with name/description/when_to_use frontmatter, ## Anti-triggers routing, capability-level MCP tool references, sibling links via relative paths.
• Canonical skill ids follow the repo's <marketplace-name>-<skill-dir> scheme (verified against check-doc-references.mjs).
• License Apache-2.0 and MSP Claude Plugins Community author, matching sibling pack/MCP plugins.

CI gates run locally (all green)

• claude plugin validate . (root marketplace) — ✔
• claude plugin validate msp-claude-plugins/eosl — ✔
• scripts/check-marketplace-drift.mjs + bump gate vs origin/main — ✔ (new plugin, no bump required)
• scripts/check-doc-references.mjs — ✔ (all skill-shaped references resolve)
• scripts/check-tool-anchoring.mjs — ✔ (the 3 new skills add nothing to the un-anchored inventory)

Assumptions / stubs a reviewer must verify

1. PSA-pull step is a stub in eosl-psa-lifecycle-audit — no Autotask/ConnectWise API call is hardcoded. It points at the real autotask-configuration-items skill and connectwise-psa-lookup-config command and instructs discovering the connected PSA's actual tools and confirming which configuration-item field holds a manufacturer part/model usable as an EOSL key. Wire and test against a live PSA before relying on it.
2. EOSL.ai tool names are described at the capability level (eosl__lookup_part, eosl__bulk_check, eosl__search_families, eosl__get_family_lifecycle, eosl__list_vendors). The five capabilities were verified against the live service, but the exact registered tool names should be confirmed from the tool list a connected session shows — they may differ from these labels.
3. EOSL.ai is a third-party, anonymously-operated, no-auth public service. Confirm it's acceptable to send client part numbers to it, and that WYRE is comfortable listing it in the marketplace, before merge.

Built overnight autonomously; opened as draft for human review. Do not merge without the PSA-integration and tool-name verification above.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}