chore: sync core lib and CLAUDE.md from agent-core

[avifenesh]

Automated sync of lib/ and CLAUDE.md from agent-core.

---

Note

Medium Risk
Adds a new provenance-verification gate to the runtime binary download/install path and introduces dependency on the external gh CLI, which could cause install failures or behavior differences across environments when required.

Overview
Strengthens the binary install pipeline by adding an additional verification step that checks SLSA build provenance using gh attestation verify before extracting/installing the downloaded archive.

SLSA verification is soft by default (warn-and-continue when gh is missing) but can be made mandatory via AGENT_ANALYZER_REQUIRE_ATTESTATION=1 or requireAttestation; a failed attestation check hard-fails the install. The download APIs (downloadBinary, ensureBinary, ensureBinarySync) now accept skipAttestation plus injectable ghRunner/ghProbe, and the sync path now forwards requireAttestation into its child process invocation.

^{Reviewed by Cursor Bugbot for commit 1974905. Configure here.}

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!