feat: add guided production virtual patch demo

[ejntaylor]

Summary

• add demo node-serialize, a production-backed walkthrough that scans the exact vulnerable dependency, waits for live rule 18843, installs and verifies the runtime guard, then prints shell-safe exploit and benign requests
• add demo-guide node-serialize, a read-only, state-aware local walkthrough with the next exact command, restart instructions, expected proof, and cleanup
• derive the public Pulse rules URL from the configured manifest endpoint
• document and test the complete Host-connected Bolt workflow

Why

Bolt's Host connection provisions the site, but demonstrating a server-side virtual patch still required several manual and easy-to-miss steps: re-reporting the manifest after adding the vulnerable dependency, waiting for the live rule, wiring the runtime guard, restarting the app, and constructing a shell-safe exploit request.

These commands turn that process into one guided local workflow. No deployment is required.

Impact

The active demo is intentionally constrained to production mode, the Host-persisted site UUID, and exactly node-serialize@0.0.4 in the lockfile. It does not install or execute the vulnerable package, start or restart the server, or send test traffic. The companion guide is read-only and does not contact Patchstack.

Stack dependency

This is stacked on the JavaScript Express guard work in #87, which itself depends on #86. Merge order: #86 → #87 → this PR; retarget each stacked PR to main after its dependency merges.

Validation

• npm run typecheck
• npm test — 42 files, 490 tests
• npm run build
• end-to-end production-flow smoke against a local mock Pulse endpoint, including delayed rule 18843 delivery, generated ESM Express guard wiring, and shell-safe test output

[coderbuds]

Comprehensive demo feature with clear docs and extensive testing coverage.

🎯 Quality: 95% Elite · 📦 Size: Extra Large — strongly consider breaking this down

🛡️ Standards: no pre-flight fit check ran for this change — wire assess-change-fit into your coding agents to catch size before opening.

📈 This month: Your 235th PR — above team average · Averaging Good

_{See how your team is trending →}

[ejntaylor]

/review

[patchstackdave]

I wonder if we should perhaps also bake in the other sample rules we have that (should) get added through "patchstack-connect protect --demo" or we keep it separate.

[patchstackdave]

Demo UUID hardcoded is fine?

[ejntaylor]

I think so - would be good to demo a bunch of different types.