chore: sync core lib and CLAUDE.md from agent-core

[avifenesh]

Automated sync of lib/ and CLAUDE.md from agent-core.

---

Note

Medium Risk
Adds an additional provenance-verification gate (gh attestation verify) to the binary download/install path, which can cause new install failures when gh is present but verification fails or when attestation is required in CI.

Overview
Strengthens the binary download/install flow by adding an optional (or CI-required) SLSA build provenance verification step via gh attestation verify, in addition to the existing .sha256 sidecar check.

Introduces verifySlsaAttestation/isGhAvailable helpers and new downloadBinary/ensureBinary/ensureBinarySync options (skipAttestation, requireAttestation, injectable ghRunner/ghProbe), including forwarding requireAttestation through the sync child-process path and failing installs on attestation verification errors.

^{Reviewed by Cursor Bugbot for commit 6c0a59b. Configure here.}

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!