chore: sync core lib and CLAUDE.md from agent-core

[avifenesh]

Automated sync of lib/ and CLAUDE.md from agent-core.

---

Note

Medium Risk
Changes the binary download/install verification flow by adding gh attestation verify gating, which can now fail installs depending on gh availability and attestation status. Moderate risk because it affects runtime bootstrap paths and introduces new environment/CLI dependencies, though it is soft-default with clear escape hatches for local dev.

Overview
Strengthens the analyzer binary install pipeline by adding an optional SLSA provenance verification step after SHA-256 checking, using gh attestation verify against agent-sh/agent-analyzer release attestations.

Introduces skipAttestation (local-dev only) and AGENT_ANALYZER_REQUIRE_ATTESTATION/requireAttestation to control whether a missing gh CLI is a warning or a hard failure, while any explicit attestation verification failure always aborts install. Updates both async ensureBinary() and ensureBinarySync() to pass through these new options, and exports verifySlsaAttestation/isGhAvailable for testing/advanced use.

^{Reviewed by Cursor Bugbot for commit 565289f. Configure here.}

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!