Merge origin/main into feat/agent-skills-runtime

Resolved 11 conflict regions across 7 files:
- nightly.yml: kept origin/main (weekly + on-change schedule from PR #3)
- All others (Dockerfile, nsjail-base.cfg, programmatic.py, executor.py,
  nsjail.py, pool.py): kept HEAD (agent skills runtime customizations
  for LibreOffice, /opt/skills mount, SKILLS_ROOT env, language-aware
  /proc unmask + seccomp policy)

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

Author: 3 people

.github/workflows/nightly.yml

@@ -2,7 +2,11 @@ name: Nightly Validation
 
 on:
   schedule:
-    - cron: '23 4 * * *'
+    # Weekly full validation: Sunday 04:23 UTC (catches environment drift)
+    - cron: '23 4 * * 0'
+  push:
+    # On-change: run full suite on every push to main/dev
+    branches: [main, dev]
   workflow_dispatch:
 
 concurrency:

.gitleaks.toml

@@ -0,0 +1,9 @@
+# EXI-DLP gitleaks config — whitelist upstream false positives
+# Findings are test files with placeholder API keys and SECURITY.md
+# with curl auth examples from upstream authors (Joe Licata).
+[allowlist]
+description = "Test fixtures and security documentation examples"
+paths = [
+    '''tests/''',
+    '''docs/''',
+]