chore: sync core lib and CLAUDE.md from agent-core

[avifenesh]

Automated sync of lib/ and CLAUDE.md from agent-core.

---

Note

Medium Risk
Adds an additional verification step to the binary download/install path by invoking gh attestation verify, which can cause installs to fail in environments without gh when attestation is required or when verification fails. Changes affect runtime bootstrap and temp-file handling for downloaded artifacts.

Overview
Strengthens the analyzer binary installation flow by adding optional/required SLSA build provenance verification via gh attestation verify after the existing SHA-256 sidecar check.

Introduces verifySlsaAttestation/isGhAvailable, new options (skipAttestation, requireAttestation, injectable ghRunner/ghProbe), and forwards these through ensureBinary and ensureBinarySync (including child-process invocation), failing hard on attestation verification failures and optionally on missing gh (via AGENT_ANALYZER_REQUIRE_ATTESTATION=1).

^{Reviewed by Cursor Bugbot for commit 1fef02a. Configure here.}

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!