[pull] main from github:main

[pull]

See Commits and Changes for more details.

---

Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

---

Summary by cubic

Hardened expression safety and MCP tooling, stabilized action pin version comments, and bumped @playwright/cli to 0.1.13. Also moved noisy fuzz tests to the integration suite and clarified docs/specs.

• Bug Fixes

  • Block line-terminator and malformed comparison expressions; fix comparison parsing; add fuzz case and tests.
  • Treat “No deferred tool marker” as terminal in claude_harness; add unit test.
  • Return JSON-RPC method-not-found for unknown MCP tools; refresh tool icons; add tests; null-safe set_issue_field; clearer set_issue_field.value schema.
  • Keep version comments consistent after dynamic action pin resolution; add tests.
  • Copilot PR NLP: forbid agent-side pip install; require /tmp/gh-aw/venv/bin/python3.
  • Spec Librarian: require explicit safe output (noop or create_issue) in strict runs.
  • Move sanitize_* fuzz tests behind integration tag; CI runs them with -tags=integration.
  • Q workflow: remove unused import; add parallel batching guidance.

• Dependencies

  • Bump default @playwright/cli to 0.1.13 across workflows, constants, docs, and goldens.
  • Docs: update ET compliance table, finalize text-based frontmatter hash approach, add MCP Scripts norms audit, and clarify Quick Start gh auth prerequisites.

^{Written for commit a0fc1e6. Summary will update on new commits.}