feat: mock-publish channel order with social-sdk mockBackend

[DealAppSeo]

Mock publish for the channel order. Nothing is posted live.

• scripts/cmo-mock-publish.mjs calls @opencoredev/social-sdk mockBackend (immediate-text-success) for LinkedIn, then TikTok, then YouTube.
• docs/CHANNEL.md records that order and the inbox clips 01-lie, 02-caught, 03-receipt.
• tests/cmo-jev.test.ts fails when stake or VETO is spoken as a product claim.

@opencoredev/social-sdk is a devDependency. The script is not in files[]. No HeyGen. REAL_STAKING was not flipped.

Related to #199.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
trustshell-landing	Ready	Preview	Sep 26, 2026 9:29pm UTC

[strix-security]

Strix Security Review

No security issues found.

Review summary

Reviewed the five changed files: the cmo-mock-publish.mjs script, its CHANNEL.md documentation, the cmo-jev.test.ts test, and the package.json/package-lock.json additions. The publish script uses @opencoredev/social-sdk's mockBackend with purely hardcoded, non-sensitive inputs and ships only mock publish state to stdout; it is not included in the published package's files[]. The test spawns the script via a static executable and path with no attacker-controllable input. The new @opencoredev/social-sdk package is a devDependency consumed only by the mock script and test and is not part of the runtime bundle. No injection sinks, hardcoded credentials, unsafe deserialization, or other security-relevant defects were found in the changed code.

_{Updated for 282539e.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[strix-security]

Reviewed the five changed files: the cmo-mock-publish.mjs script, its CHANNEL.md documentation, the cmo-jev.test.ts test, and the package.json/package-lock.json additions. The publish script uses @opencoredev/social-sdk's mockBackend with purely hardcoded, non-sensitive inputs and ships only mock publish state to stdout; it is not included in the published package's files[]. The test spawns the script via a static executable and path with no attacker-controllable input. The new @opencoredev/social-sdk package is a devDependency consumed only by the mock script and test and is not part of the runtime bundle. No injection sinks, hardcoded credentials, unsafe deserialization, or other security-relevant defects were found in the changed code.

---

Reviewed by Strix
_{Configure security review settings}