[upstream #10654] feat(agents): add ZCode as first-class supported agent

.gitattributes

@@ -10,3 +10,5 @@
 /skill-stubs/*.md text eol=lf
 /skills/*/SKILL.md text eol=lf
 /src/cli/bundled-skill-guides.ts text eol=lf
+# Bundled plugin trees are byte-hashed; CRLF checkout would break the pinned hash.
+/resources/plugins/** text eol=lf

.github/actions/install-node-dependencies/action.yml

@@ -0,0 +1,68 @@
+name: Install Node dependencies
+description: Installs the Node toolchain and repository dependencies for Linux CI jobs.
+
+inputs:
+  native-runtime:
+    description: Native runtime to prepare after the script-free install (none, node, or electron).
+    required: false
+    default: none
+
+runs:
+  using: composite
+  steps:
+    # setup-node needs pnpm on PATH to locate and restore its store.
+    - name: Setup pnpm
+      uses: pnpm/action-setup@v6
+      with:
+        run_install: false
+
+    - name: Setup Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version-file: package.json
+        cache: pnpm
+
+    - name: Validate native runtime
+      shell: bash
+      env:
+        NATIVE_RUNTIME: ${{ inputs.native-runtime }}
+      run: |
+        case "$NATIVE_RUNTIME" in
+          none|node|electron) ;;
+          *)
+            echo "::error::native-runtime must be none, node, or electron"
+            exit 2
+            ;;
+        esac
+
+    # pnpm's bundled gyp_main.py is not executable on fresh Linux runners.
+    - name: Use external node-gyp
+      if: inputs.native-runtime != 'none'
+      shell: bash
+      run: |
+        npm install -g node-gyp@11.5.0
+        echo "npm_config_node_gyp=$(npm root -g)/node-gyp/bin/node-gyp.js" >> "$GITHUB_ENV"
+
+    - name: Prepare dependency install
+      shell: bash
+      run: |
+        if [ -e node_modules ]; then
+          ls -ld node_modules
+          rm -rf node_modules
+        fi
+
+    - name: Install dependencies
+      shell: bash
+      run: |
+        pnpm install \
+          --no-frozen-lockfile \
+          --prefer-frozen-lockfile=false \
+          --ignore-scripts
+        git diff --exit-code package.json pnpm-lock.yaml
+
+    - name: Prepare native runtime
+      if: inputs.native-runtime != 'none'
+      shell: bash
+      env:
+        NATIVE_RUNTIME: ${{ inputs.native-runtime }}
+      run: node config/scripts/ensure-native-runtime.mjs --runtime="$NATIVE_RUNTIME"

.github/workflows/e2e.yml

@@ -1,5 +1,11 @@
 name: E2E
 
+run-name: E2E ${{ inputs.ref || github.ref }}
+
+# Why: checkout + artifact upload only; callers can only further restrict.
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:
@@ -76,7 +82,7 @@ jobs:
     name: e2e ${{ matrix.shard_name }}
     needs: build
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:

.github/workflows/mobile-ios-release.yml

@@ -10,7 +10,7 @@ on:
   workflow_dispatch:
     inputs:
       bump_patch_version:
-        description: 'Bump the iOS marketing version patch number before release. Tick this after a version has shipped to the App Store (the release fails fast if the current version''s train is already closed).'
+        description: 'Use the first open iOS patch version after the checked-in version, skipping versions already closed on the App Store.'
         required: false
         default: false
         type: boolean

.github/workflows/mobile.yml

@@ -30,6 +30,11 @@ jobs:
         with:
           node-version-file: package.json
 
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
         with:
@@ -56,6 +61,9 @@ jobs:
       - name: Test
         run: pnpm test
 
+      - name: Test iOS release version resolution
+        run: ruby fastlane/ios_release_version_test.rb
+
       - name: Lint
         run: pnpm lint