Promote develop to main: Re-vendor the Carried Hub Files, With 21 Dependency Bumps

.dockerignore

@@ -1,26 +1,26 @@
-**/.mount
-**/.classpath
-**/.dockerignore
-**/.env
-**/.git
-**/.gitignore
-**/.project
-**/.settings
-**/.toolstarget
-**/.vs
-**/.vscode
-**/*.*proj.user
-**/*.dbmdl
-**/*.jfm
-**/azds.yaml
-**/bin
-**/charts
-**/docker-compose*
-**/Dockerfile*
-**/node_modules
-**/npm-debug.log
-**/obj
-**/secrets.dev.yaml
-**/values.dev.yaml
-LICENSE
+**/.mount
+**/.classpath
+**/.dockerignore
+**/.env
+**/.git
+**/.gitignore
+**/.project
+**/.settings
+**/.toolstarget
+**/.vs
+**/.vscode
+**/*.*proj.user
+**/*.dbmdl
+**/*.jfm
+**/azds.yaml
+**/bin
+**/charts
+**/docker-compose*
+**/Dockerfile*
+**/node_modules
+**/npm-debug.log
+**/obj
+**/secrets.dev.yaml
+**/values.dev.yaml
+LICENSE
 README.md

.editorconfig-checker.json

@@ -1,10 +1,17 @@
-{
-  "Disable": {
-    "Charset": true,
-    "Indentation": true,
-    "IndentSize": true,
-    "TrimTrailingWhitespace": true,
-    "InsertFinalNewline": true,
-    "MaxLineLength": true
-  }
-}
+{
+  "Exclude": [
+    "(^|/)__pycache__/",
+    "(^|/)\\.mypy_cache/",
+    "(^|/)\\.pytest_cache/",
+    "(^|/)\\.ruff_cache/",
+    "(^|/)\\.venv/"
+  ],
+  "Disable": {
+    "Charset": true,
+    "Indentation": true,
+    "IndentSize": true,
+    "TrimTrailingWhitespace": true,
+    "InsertFinalNewline": true,
+    "MaxLineLength": true
+  }
+}

.gitattributes

@@ -1,16 +1,7 @@
-# Default: do not normalize line endings (`* -text`); .editorconfig end_of_line rules guide what the editor writes.
-# The exception pins below are git's own enforcement - they force LF for execution-sensitive classes regardless of editor.
-# git config --global core.autocrlf false
-# git add --renormalize .
-# git ls-files --eol
-* -text
-
-# Exception: scripts must stay LF regardless of the `* -text` default - a CRLF shebang breaks execution. `.editorconfig`
-# covers `*.sh`, but extensionless executables (s6 service scripts, hooks) match no extension rule, so pin them here so
-# git enforces LF on checkout and `--renormalize`. A repo shipping extensionless scripts adds an explicit path rule,
-# e.g. for s6-overlay init: `Docker/s6-overlay/** text eol=lf`.
-*.sh text eol=lf
-
-# Dockerfiles must be LF - a CRLF breaks RUN heredocs and line continuations.
-Dockerfile text eol=lf
-*.Dockerfile text eol=lf
+# Normalize every detected text file to LF in the index and on checkout.
+# `text=auto` leaves binary files byte-preserved.
+* text=auto eol=lf
+
+# Windows command scripts require CRLF.
+*.bat text eol=crlf
+*.cmd text eol=crlf

.github/dependabot.yml

@@ -1,27 +1,25 @@
-# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-# Each ecosystem appears once per branch (main + develop) so both stay current independently; rationale in
-# AGENTS.md "Branching Model". This repo ships a Docker image only, so github-actions is the sole ecosystem.
-version: 2
-updates:
-
-  # main
-  - package-ecosystem: "github-actions"
-    target-branch: "main"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      actions-deps:
-        patterns:
-          - "*"
-
-  # develop
-  - package-ecosystem: "github-actions"
-    target-branch: "develop"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      actions-deps:
-        patterns:
-          - "*"
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+version: 2
+updates:
+
+  # main
+  - package-ecosystem: "github-actions"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"
+
+  # develop
+  - package-ecosystem: "github-actions"
+    target-branch: "develop"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"

.github/skills/add-host-tool/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: add-host-tool
+description: >-
+  Adds or changes a managed host tool across the ptr727/ProjectTemplate fleet contract, Linux and
+  Windows installers, platform documentation, and tests. Use this whenever adding, removing,
+  renaming, or changing the source, probe, version floor, install, report, upgrade, or dry-run
+  behavior of a tool in host-setup or spec/host-tools.json. Triggers even when the request names
+  only one platform, because a required fleet tool needs an executable remedy everywhere it
+  applies and native verification must stay on the platform being tested.
+---
+
+# Add Host Tool
+
+## Establish the Contract
+
+1. Read the issue and all follow-up comments before choosing a source or package identifier.
+2. Add the tool to `spec/host-tools.json` in name order.
+3. Use the executable's real version banner for the probe and pattern.
+4. Set a floor only when it is measured or anchored to every supported distribution.
+5. Provide `source` and executable `remedy` entries for every applicable platform.
+
+## Implement Each Platform
+
+- Keep the existing named-tool interface and default selection behavior.
+- Prefer the distribution package when it meets the floor.
+- Use the platform's established package manager and official package identifier.
+- Keep install and upgrade idempotent.
+- Before an apt-managed install, detect and remove an unowned downloaded copy that shadows it.
+- Before a downloaded install, detect and remove a conflicting package-managed copy.
+- Preserve report, list, explicit selection, install, upgrade, reinstall, and dry-run behavior.
+- Do not test a Windows mutation on Linux or a Linux mutation on Windows.
+
+When a platform is unavailable, verify its registry and tests without claiming a native install. Hand off the exact native commands and expected observations to the operator.
+
+## Update the Complete Surface
+
+Update the platform installers, `spec/host-tools.json`, `docs/host-setup.md`, and the applicable platform READMEs. Update installer and host-gate tests for selection, reporting, installation, upgrade, and dry-run behavior. Sweep prose that describes tool sources or the managed set.
+
+## Verify
+
+1. Run the spec validator and the focused installer and host-gate tests.
+2. Run the repository's formatting, lint, type, and test gates required by the changed files.
+3. On the current native platform, exercise list and report first.
+4. Exercise install and upgrade dry runs.
+5. Apply the install, repeat it to prove idempotence, and run the host gate.
+6. Record untested platforms explicitly and leave cross-platform verification open.