[pull] main from github:main

[pull]

See Commits and Changes for more details.

---

Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

---

Summary by cubic

Adds a first‑class engine.permission-mode to Claude workflows and improves cross‑host workflow resolution on GHE by routing known public orgs to github.com with clearer 404 hints.

• New Features

  • Introduced engine.permission-mode (auto, acceptEdits, plan, bypassPermissions) in the workflow schema and compiler. Default is acceptEdits; workflows with tools.edit: false use auto. Bash wildcards no longer force bypassPermissions.
  • Added boolean support for tools.edit so edit: false cleanly disables edit tools.
  • On GHE, shorthand sources under github/*, githubnext/*, and microsoft/* now resolve on github.com. When a 404 occurs, the CLI suggests the exact github.com URL to try. Help text for add, add-wizard, and update now explains this behavior.

• Refactors

  • Tightened the PR Code Quality Reviewer workflow to use a stricter first‑pass “grumpy” sub‑agent and enforce a higher bar for merge.
  • Added lightweight debug logging to sliceutil, stats, stringutil, and timeutil. Updated Codex shell env allowlist to anchored patterns.
  • Docs: added ADRs for permission mode decoupling and GHE shorthand fallback; updated README and weekly blog.

^{Written for commit 80265a5. Summary will update on new commits. Review in cubic}