feat(builtins): add markkit and fetchkit builtins with the upstream CLI

.github/workflows/ci.yml

@@ -378,6 +378,15 @@ jobs:
           cargo test -p bashkit --features terminal --test integration -- terminal_tests l_term_
           cargo test -p bashkit --features terminal --doc terminal
 
+      # markkit/fetchkit builtins are `cfg(markkit|fetchkit)` (off by default),
+      # so the main "Run tests" step compiles them out entirely.
+      - name: Run markkit/fetchkit builtin tests
+        run: |
+          cargo test -p bashkit --features markkit,fetchkit --lib -- builtins::markkit:: builtins::fetchkit::
+          cargo test -p bashkit --features markkit,fetchkit --test integration -- markkit_builtin_tests fetchkit_builtin_tests
+          cargo test -p bashkit --features markkit --test integration -- markkit_builtin_tests
+          cargo test -p bashkit --features markkit,fetchkit --doc -- markkit_fetchkit_guide
+
       - name: Run fail-point tests (single-threaded)
         run: cargo test --features failpoints --test security_failpoint_tests -- --test-threads=1
 
@@ -526,6 +535,7 @@ jobs:
           cargo run --example realfs_readwrite --features realfs
           cargo run --example sqlite_basic --features sqlite
           cargo run --example sqlite_workflow --features sqlite
+          cargo run --example markkit_fetchkit --features markkit,fetchkit
           cargo run --example terminal_vi --features terminal
           cargo run --example terminal_record --features terminal
 

AGENTS.md

@@ -52,6 +52,7 @@ Fix root cause. Unsure: read more code; if stuck, ask w/ short options. Unrecogn
 | security/request-signing | Transparent Ed25519 request signing (bot-auth) per RFC 9421 |
 | integrations/interactive-shell | Interactive REPL mode with rustyline line editing |
 | integrations/in-process-terminal | In-memory PTY-like `Terminal` (feature `terminal`), screen text, `vi` builtin |
+| runtimes/markkit-fetchkit-builtins | `markkit`/`fetchkit` builtins: same CLI via upstream `run(args, host)`, VFS + allowlist |
 | runtimes/sqlite-builtin | Embedded SQLite via Turso (MemoryIO + VfsIO backends, dot-commands) |
 | runtimes/coreutils-args-port | Codegen port of uutils clap definitions + uucore modules |
 | security/credential-injection | Per-host HTTP credential injection without exposing secrets |