chore: sync core lib and CLAUDE.md from agent-core

[avifenesh]

Automated sync of lib/ and CLAUDE.md from agent-core.

---

Note

Medium Risk
Adds a new verification gate in the binary download/install path that can hard-fail installs based on gh attestation verify results, which may affect environments without GitHub CLI or with unexpected attestation failures. Changes are security-focused but touch runtime installation flow and error handling.

Overview
Adds an additional supply-chain verification step for downloaded agent-analyzer release assets by optionally verifying SLSA build provenance via gh attestation verify before extraction.

The attestation check is soft by default (warn-and-continue when gh is missing) but can be made required via AGENT_ANALYZER_REQUIRE_ATTESTATION=1 or requireAttestation; failed verification from a present gh now aborts installation. ensureBinary/ensureBinarySync and downloadBinary accept new options (skipAttestation, requireAttestation, and injectable ghRunner/ghProbe) and export verifySlsaAttestation/isGhAvailable for testing/advanced use.

^{Reviewed by Cursor Bugbot for commit 7d8033f. Configure here.}

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!