http-fetch/firecrawl: replace npx launch with a shipped wrapper (v5 / 1.1.0)

Both connectors declared `mcp_config: {command: "npx", args: ["-y", "<pkg>"]}`
and shipped no code at all. Skald treats a mcp_local `args[0]` as the *name of
the file to run*, not as an argument: install stores `script_path = "<id>/-y"`
and global_enable launches `npx /…/connectors/<id>/-y`, a path that does not
exist. The server never answered `initialize`, so start_server failed — and
since global_enable still returns 200 with an `error` in the body, the UI showed
the connector as enabled while `render_mcp_list` (built from the live runtime)
left it out of the agent's system context entirely.

Ship a two-file wrapper instead: a package.json pinning the upstream package
(mcp-fetch-server@1.1.2, firecrawl-mcp@3.23.7) and an index.js importing it for
its side effect, so `node index.js` is a real local_script and
ensure_installed_host installs the deps beside it. No node_modules, no lockfile.

Also: drop the legacy `launch_command` / top-level `transport` / `dependencies`
fields; drop firecrawl's inert `mcp_config.env` placeholder (same case as gmaps
— tokens are only substituted in the URL); add firecrawl_developer_search to
firecrawl's tools[] and API_KEY to its requires; realign manifest and fragment
versions to 5 / 1.1.0 (they were 2 vs 4, so no Update badge could ever appear).

Verified end-to-end against the shipped files by reproducing Skald's own path:
`npm ci || npm install --omit=dev` then `node <abs>/index.js` — initialize,
tools/list and a real tools/call, JSON-RPC only on stdout.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

connectors/http-fetch/index.js

@@ -0,0 +1,13 @@
+// Skald connector entry point.
+//
+// The MCP server itself is the upstream `mcp-fetch-server` package, pinned in
+// package.json and installed by Skald beside this file (`npm ci --omit=dev`,
+// falling back to `npm install --omit=dev`).
+//
+// This file exists because Skald launches a `mcp_local` connector as
+// `<command> <mcp_config.args[0]>`, where args[0] is rewritten to the absolute
+// path of a *shipped* file — so `npx -y <package>` cannot be expressed: args[0]
+// would be taken as the entry file's name. Importing the package's server module
+// for its side effect (it starts the stdio JSON-RPC loop at import time) is the
+// whole of the wrapper.
+import "mcp-fetch-server/dist/index.js";