chore: sync core lib and CLAUDE.md from agent-core

[avifenesh]

Automated sync of lib/ and CLAUDE.md from agent-core.

---

Note

Medium Risk
Adds a new attestation-verification gate to the runtime binary download path, which can now hard-fail installs depending on gh availability and configuration. Risk is moderate because it affects bootstrap/install behavior across platforms and introduces a new dependency on the GitHub CLI for stricter environments.

Overview
Strengthens the binary download pipeline by adding optional SLSA build provenance verification using gh attestation verify, executed after SHA-256 verification and before extraction.

Introduces new knobs (skipAttestation, requireAttestation / AGENT_ANALYZER_REQUIRE_ATTESTATION=1) and propagates them through downloadBinary, ensureBinary, and ensureBinarySync (including forwarding requireAttestation into the sync child process). Exposes verifySlsaAttestation and isGhAvailable for testing/advanced usage, and adds warnings vs hard failures depending on whether gh is missing or the attestation check fails.

^{Reviewed by Cursor Bugbot for commit 83387c7. Configure here.}

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!