chore: sync core lib and CLAUDE.md from agent-core

[avifenesh]

Automated sync of lib/ and CLAUDE.md from agent-core.

---

Note

Medium Risk
Adds an optional/required gh attestation verify gate to the runtime binary download/install flow, which changes install-time behavior and introduces a new dependency on the gh CLI and environment/config flags.

Overview
Strengthens the analyzer binary install verification by adding SLSA build provenance attestation checks via gh attestation verify in downloadBinary() after SHA-256 validation.

The attestation step is soft by default (warns and continues if gh is missing) but can be made mandatory with AGENT_ANALYZER_REQUIRE_ATTESTATION=1 / requireAttestation, and failures from gh now abort installation; new skipAttestation and test-injection hooks (ghRunner/ghProbe) are threaded through ensureBinary() and ensureBinarySync().

^{Reviewed by Cursor Bugbot for commit d274655. Configure here.}

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!