Merge commit from fork

Harden filesystem writes against symlinks

Merge pull request cli#14462 from cli/revert-14437-williammartin-appl…

…e-codesign-action

Revert "Use internal Apple codesign action"

Merge pull request cli#14337 from cli/williammartin-ghes-api-telemetry

Disable telemetry for unauthenticated GHES `gh api` requests using absolute hostnames

Merge pull request cli#14260 from cli/tommaso-moro-support-pi-agent-d…

…irectory

Support PI_CODING_AGENT_DIR for skills

Merge commit from fork

fix: bind to loopback by default in `codespace ports forward`

Merge commit from fork

* Escape regex metacharacters in attestation SAN matching

Apply regexp.QuoteMeta to user-supplied values interpolated into regex
patterns in expandToGitHubURLRegex and validateSignerWorkflow. Without
escaping, dots in org/repo names act as regex wildcards, allowing
attestation spoofing via lookalike repositories.

Co-authored-by: Copilot <[email protected]>

* Address review: QuoteMeta entire static string at once

Per review feedback, wrap the full formatted string in QuoteMeta
rather than individual variables, to better indicate the whole piece
is escaped and avoid confusion around trailing/leading chars.

Co-authored-by: Copilot <[email protected]>

---------

Co-authored-by: Copilot <[email protected]>

Merge commit from fork

* Validate Jupyter Server URLs

* Validate Jupyter Server URLs: address reviews

* Validate Jupyter Server URLs: address test reviews

* Validate Jupyter Server URLs: address test reviews

feat(skills): list available skills when install runs non-interactive…

…ly (cli#13548)

Co-authored-by: sammorrowdrums <[email protected]>
Co-authored-by: Copilot <[email protected]>

Add gh discussion and Issues 2.0 reference to the `gh` skill, plus a …

…README note (cli#13631)

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Co-authored-by: Babak K. Shandiz <[email protected]>

Merge pull request cli#13536 from cli/bagtoad/kw-fix-attestation-inte…

…gration-tests

fix CI attestation integration tests after rename