Merge main branch and recompile workflows

[Copilot]

Merged latest main branch into security fix PR and recompiled all workflow lock files to sync with updated dependencies and schema changes.

Changes

• Merge: Integrated 3937 commits from main using --allow-unrelated-histories (grafted branch)
• Conflict resolution: Preserved security fix in sanitize_content_core.cjs, adopted main versions for all other files
• Recompilation: Updated 123 workflow lock files with latest action pins and embedded JavaScript

Security fix preserved

The single atomic regex replacement for XML comment removal remains intact:

// Before (vulnerable to injection via chained operations)
s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");

// After (atomic operation prevents injection)
s = s.replace(/<!--[\s\S]*?--!?>/g, "");

Notes

• One workflow (smoke-copilot.md) has pre-existing validation error unrelated to this merge
• Embedded JavaScript in pkg/workflow/js/ updated via build system

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.