fix(ci): agy reviewer must fall back on GitHub's FILES limit, not just lines

.github/actionlint.yaml

@@ -0,0 +1,25 @@
+# actionlint configuration.
+#
+# actionlint validates `runs-on:` against GitHub's list of hosted-runner labels
+# and reports anything else as unknown, because a typo'd label is a job that
+# queues forever rather than failing. Self-hosted labels therefore have to be
+# declared here — that is the mechanism actionlint's own diagnostic points at.
+#
+# Without this file, `actionlint` reports an error on EVERY run in a repo that
+# has the reviewer installed. That is not a harmless false positive: a linter
+# that always reports something is a linter people stop reading, and the real
+# findings go with it.
+#
+# Run it over the whole tree with:
+#
+#   actionlint
+#
+# (no arguments — it discovers `.github/workflows/*.yml` and reads this file.)
+
+self-hosted-runner:
+  labels:
+    # The maintainer's self-hosted runner for the Antigravity PR reviewer
+    # (`.github/workflows/antigravity-review.yml`, `runs-on: [self-hosted, agy]`).
+    # It is a personal machine holding the `agy` CLI's Google AI Ultra OAuth
+    # session, which is why that workflow cannot run on a hosted runner.
+    - agy

.github/workflows/antigravity-review.yml

@@ -53,6 +53,10 @@ jobs:
       group: agy-review-${{ github.event.pull_request.number || github.event.issue.number }}
       cancel-in-progress: false
     runs-on: [self-hosted, agy]
+    # Bounded harder than the hosted jobs, not softer: this runs on the
+    # maintainer's own hardware, so a hung run holds a real machine rather than
+    # a disposable VM. Observed runtime is 1-3 minutes.
+    timeout-minutes: 30
     steps:
       # Check out the DEFAULT BRANCH, never the PR head. This job runs the checked-out
       # `scripts/agy-review.sh` on a self-hosted runner with a token in the environment,
@@ -63,6 +67,12 @@ jobs:
       # branch throughout. Consequence worth knowing: a PR that edits the reviewer or the
       # style guide is reviewed by the version already on the default branch until it merges.
       - name: Check out repo (for the style guide + scripts)
+        # SHA-pinned, not `@v7`: this job runs on a SELF-HOSTED runner -- the
+        # maintainer's own machine -- so a compromised tag would execute there
+        # rather than in a disposable VM. Verified to be exactly what `v7`
+        # resolves to (v7.0.1, 2026-07-17). The trailing `# v7` is the form
+        # Dependabot's github-actions ecosystem reads to keep the pin current.
+        # Adopted FROM RustySNES and SLAC, which had it while the template did not.
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ github.event.repository.default_branch }}
@@ -91,5 +101,21 @@ jobs:
           # MAX_PROMPT_BYTES: "125000"     # inline/file threshold + hard backstop on the argv prompt
           # STYLE_GUIDE: .github/agy-review.md   # style guide, loaded if present
         run: |
+          # The workflow and the scripts come from DIFFERENT REFS: for a `pull_request`
+          # event GitHub runs this YAML from the PR branch, while the checkout step
+          # above deliberately fetches the DEFAULT branch to get the scripts. So a
+          # change that adds a script file breaks its own PR -- the new workflow
+          # chmods a file the default branch does not have yet. Observed exactly
+          # once, on the PR that introduced `_agy_comment_body.sh`.
+          #
+          # The two required files are chmod'd unconditionally; anything added later
+          # is chmod'd only if present, so the workflow stays compatible with both
+          # the old and the new script set. A genuinely missing required file still
+          # fails loudly -- `agy-review.sh` sources it and dies -- rather than being
+          # papered over here.
           chmod +x scripts/agy-review.sh scripts/_agy_print.sh
+          for opt in scripts/_agy_comment_body.sh; do
+            [ -f "$opt" ] && chmod +x "$opt"
+          done
+          true
           scripts/agy-review.sh

CHANGELOG.md

@@ -9,6 +9,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- **`webbrowser` 1.2.1 → 1.2.4, closing RUSTSEC-2026-0257** (`BROWSER` argument
+  injection on Unix). Reached transitively through `egui-winit`: on Unix the
+  affected versions substituted the URL into the `BROWSER` template *before*
+  tokenizing with `split_ascii_whitespace()`, so a URL retaining spaces could
+  become extra browser arguments — reproduced upstream against Chromium with
+  `--remote-debugging-port` and `--proxy-server`.
+
+  The advisory was failing `Cargo Deny Check` and `Dependency Audit` on `main`,
+  not only on a branch, so this had been shipping.
+
+### Changed
+
+- **Every dependency moved to its latest semver-compatible version** — 141
+  packages, `cargo update`. Not a targeted patch of the one vulnerable crate:
+  the whole graph is now current, which is the state a security gate can
+  meaningfully assert against.
+
+  Verified rather than assumed: `cargo deny check` reports **advisories ok, bans
+  ok, licenses ok, sources ok**, and the workspace is green at **66 suites / 897
+  tests / 0 failures** with `fmt`, `clippy --workspace -D warnings` and a full
+  `build` all passing.
+
+- **Two `deny.toml` advisory ignores retired on their own stated condition.** The
+  `quick-xml 0.39.4` pair (RUSTSEC-2026-0194 / RUSTSEC-2026-0195) was ignored with
+  the note *"no upgrade path exists … revisit on the next wayland-scanner /
+  smithay-client-toolkit release"*. That release arrived:
+  `wayland-scanner 0.31.10 → 0.31.11` pulls `quick-xml 0.39.4 → 0.41.0`, past the
+  `>= 0.40` the fixes live in. `cargo deny` flagged both as matching no crate, and
+  it stays green with them removed.
+
+  The `ttf-parser` ignore (RUSTSEC-2026-0192) still matches and is kept — it is an
+  informational *unmaintained* advisory on a transitive dep of `winit`'s
+  decoration stack, with no upgrade available.
+
 ## [1.31.1] "Firewall" - 2026-08-04
 
 ### Added