chore: sync core lib and CLAUDE.md from agent-core

[avifenesh]

Automated sync of lib/ and CLAUDE.md from agent-core.

---

Note

Medium Risk
Changes the binary download/install verification pipeline by adding gh attestation verify gating, which could block installs in environments without gh or with failing attestations. The logic is security-sensitive but scoped to download-time checks with clear skip/require controls.

Overview
Adds an additional verification step when downloading agent-analyzer: after SHA-256 sidecar validation, the installer can now verify SLSA build provenance via gh attestation verify, failing hard on verification errors.

Introduces skipAttestation (local-dev only) and requireAttestation/AGENT_ANALYZER_REQUIRE_ATTESTATION=1 to control behavior when gh is missing, and forwards these options through both ensureBinary() and ensureBinarySync() (including injectable ghRunner/ghProbe for tests).

^{Reviewed by Cursor Bugbot for commit 2cd8449. Configure here.}

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!