Route git push and gh pr through the sandbox supervisor broker so project
computers never receive GITHUB_TOKEN/GH_TOKEN. Remove NOPASSWD sudo from the
computer image. Localize awareness strip copy via Lingui and wire
computer-image-tools.test.sh into the validate-computer-image job.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Add git, gh, openssh-client, curl, and sudo to the computer image with a docker
smoke test. Mount deployment-owner project workspacePath at /home/rakazo/project,
align /home/rakazo file paths with shell, and resolve default branch from origin/HEAD.
Inject the owner GitHub token from encrypted deployment settings only into project
computers; enforce branch-only push, block force-push, and require approval before
the first push or gh pr in a run. Add runaway guards (tool fuse and stall pause),
collapse live narration, fix streaming progress merge, DE run strings, and Lead as
the project main Oo name. Fix evo-deploy test flake.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
