chore: sync core lib and CLAUDE.md from agent-core

[avifenesh]

Automated sync of lib/ and CLAUDE.md from agent-core.

[gemini-code-assist]

Code Review

This pull request introduces safe file reading and writing utilities to prevent Time-of-Check to Time-of-Use (TOCTOU) races. Specifically, it adds readFileWithLimit to open, stat, and read files using a single file descriptor, and integrates atomic write functions across several analyzers. The review feedback highlights critical security improvements, suggesting the use of assertNotSymlink in docs-analyzer.js and prompt-analyzer.js to prevent symlink exploits, and resolving the real path using fs.realpathSync in cross-file-analyzer.js to prevent path traversal vulnerabilities when validating root directory boundaries.

[avifenesh]

This is an auto-sync of the already-reviewed agent-core fix (PR agent-sh/agent-core#25). The auto-reviewer's symlink/TOCTOU notes are addressed by the design: reads use the fd-based readFileWithLimit, and writes use writeFileAtomic (temp file + atomic rename). rename() replaces the path entry itself and never follows a symlink to its target, so it is symlink-safe by construction - the explicit assertNotSymlink in fixer.js is belt-and-suspenders for that path. Merging to keep lib in sync with the source.