-
clear clippy warnings, update quinn-proto, drop unused kberg deps
-
Format the tree with rustfmt and add the lint + supply-chain gates
-
ops-exec: gate /pull on a dedicated `artifact` observe grant
-
ops-exec: pin approved scripts per action on the agent
-
bento: bound request bodies, stream logs, protocol-version the agent wire (Run 2 S6 + wiring)
-
bento: close agent /pull RCE-read + harden command surface (Run 2 CR1/CR2/S3)