[pull] main from github:main

[pull]

See Commits and Changes for more details.

---

Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

---

Summary by cubic

Upgrade the GitHub AW firewall default to v0.25.43 and migrate workflow frontmatter from rate-limit to user-rate-limit. This adds security and runtime improvements, standardizes rate limiting, and trims internal docs.

• Dependencies

  • Set default firewall to v0.25.43 across workflow locks
  • Highlights: ARC/DinD support (dockerHostPathPrefix), apiProxy.maxRuns hard cap, OIDC-based cloud credential exchange (apiProxy.auth), hidepid=2 on host procfs, plus GPT-5 BYOK wire API alignment and high‑severity patches (babel/fast-uri)

• Migration

  • Frontmatter rename: rate-limit → user-rate-limit
  • Field rename: max → max-runs-per-window
  • Update any workflow docs/configs that still use the old keys (examples: ai-moderator, auto-triage-issues)

^{Written for commit b0dbcb7. Summary will update on new commits.}