refactor(scum): declare protected run requests

openspec/changes/move-scum-feature-ownership-to-plugin/specs/scum-plugin-feature-ownership/spec.md

@@ -4,7 +4,8 @@
 
 The SCUM plugin SHALL own SCUM schemas, allowlists, migration adapters,
 Companion behavior, and feature UI. The platform SHALL retain only reusable
-authorization, isolation, auditing, queues, storage, and generic plugin-host
+authorization, isolation, approval, auditing, expiry, queues, protected
+storage, generic Run transport declarations, and generic plugin-host
 primitives. `platform_web` SHALL not import SCUM code or branch on `game.scum`.
 
 #### Scenario: Page mounting
@@ -35,3 +36,18 @@ to the server and feature, never to a game version.
 
 - **WHEN** no unique server-feature migration flag is present
 - **THEN** historical records remain readable and plugin writes stay disabled
+
+### Requirement: Protected request declarations are generic
+
+The plugin manifest and SDK SHALL support generic declared protected request
+transports for SQL, RCON, and management-program text. Declarations SHALL use
+only logical server-bound transport/target keys and bounded text fields.
+Browser projections and audit records SHALL redact request text. Declarations
+shall not grant credentials, paths, raw connections, direct sockets, or host OS
+shell execution.
+
+#### Scenario: Plugin generates an SQL request
+
+- **WHEN** the plugin queues SQL text through a declared protected transport
+- **THEN** Platform stores and audits only its protected/redacted form and
+  forwards it only after generic authorization and approval checks