chore: merge develop into daily-intelligence-2026-04-18

Resolve conflicts from develop catching up after feature branch was cut:
- Use 1.3.2 version from develop (vs 1.3.1 in feature branch)
- Fix double .claude/ path bug in daily-intelligence.md reference section
- Accept develop's lock.yml (assign_to_agent removed, correct frontmatter hash)
- Accept develop's actions-lock.json (retain setup-cli entry)
- Accept file deletions for skills/ moved to .claude/ layout
- Merge architecture file: HEAD 2026-04-18 content + Companion Projects table + detailed Claude Code section from develop

Author: zircote

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "aw-author",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "Guided authoring, validation, and refinement of GitHub Agentic Workflow (gh-aw) markdown files. Includes fully autonomous daily intelligence pipeline (research, gap analysis, implementation, PR to develop), ecosystem monitoring, knowledge base management, and GitHub Discussions integration.",
   "author": {
     "name": "Robert Allen",

.claude/skills/gh-aw-report/knowledge-base.md

@@ -71,7 +71,7 @@
 - **Modes**: Plan mode (shows plan first), Autopilot mode (fully autonomous)
 - **Background delegation**: prefix prompt with `&` to send to cloud coding agent
 - **Sub-agents**: Explore (codebase analysis), Task (build/test), Code Review, Plan
-- **Models**: Claude Opus 4.6, Claude Sonnet 4.6, GPT-5.3-Codex, Gemini 3 Pro
+- **Models**: Claude Opus 4.6, Claude Sonnet 4.6, GPT-5.3-Codex, ~~Gemini 3 Pro~~ [SUPERSEDED by 2026-04-15 — deprecated 2026-03-26]
 - **January 2026 changelog**: Enhanced agents, context management, new install methods
 
 ### GitHub Copilot Workspace / Agent Mode (as of 2026-04-14)
@@ -106,5 +106,55 @@
 - Safe Outputs subsystem handles write operations in separate permission-controlled jobs
 - Threat detection job runs per-workflow: prompt injection, credential leaks, malicious code
 
+## [2026-04-15] Daily Intelligence Update
+
+### 2026-04-15 -- version -- gh-aw CLI v0.68.3
+Released 2026-04-14. Model-not-supported detection, shared import `checkout`/`env` fields, TBT metric, OTEL token breakdowns, 5 push_signed_commits.cjs fixes.
+
+### 2026-04-15 -- version -- GitHub MCP Server v0.33.0/v0.33.1
+Released 2026-04-14. Granular PRs/issues toolsets, resolve review threads tool, `list_commits` `path`/`since`/`until` params, configurable server name.
+
+### 2026-04-15 -- deprecation -- Gemini 3 Pro deprecated
+Deprecated 2026-03-26 across all GitHub Copilot experiences. Use Gemini 3 Ultra.
+
+### 2026-04-15 -- feature -- Agent HQ and model selection
+Agent HQ: multi-vendor agents on GitHub. Model selection for Claude/Codex on github.com (2026-04-14).
+
+### 2026-04-15 -- feature -- Copilot data residency + FedRAMP
+US/EU data residency (2026-04-13). FedRAMP Moderate for US gov. `copilot --remote` public preview.
+
+### 2026-04-15 -- ecosystem -- GitHub Actions April changes
+Workflow reruns capped at 50 (2026-04-10). OIDC for Dependabot/code scanning. Code scanning→Issues linking. Async SBOM exports.
+
+---
+
+## [2026-04-16] Daily Intelligence Update
+
+### 2026-04-16 -- feature -- gh-aw v0.68.3 New Frontmatter Fields
+- **`pre-steps:`** — Runs custom steps at job start, **before checkout**. Use for token minting or pre-checkout setup. Outputs accessible via `${{ steps.<id>.outputs.<name> }}` for use in `checkout.github-token` to avoid masked-value cross-job boundary issues. Same security restrictions as `steps:`.
+- **`run-install-scripts:`** — Boolean (default: `false`). Allows npm pre/post install scripts. Default adds `--ignore-scripts` to all npm install commands (supply chain protection). Setting `true` disables globally; per-runtime scope via `runtimes.node.run-install-scripts`. Compile-time warning (strict mode: error).
+- **`on.stale-check:`** — Boolean nested under `on:`, default `true`. When `false`, disables the frontmatter hash check in the activation job. Required for cross-repo org ruleset deployments.
+- Source: PR #26607 in github/gh-aw ("Sync github-agentic-workflows.md with v0.68.3")
+
+### 2026-04-16 -- security -- gh-aw Security Fixes
+- **Steganographic injection**: PR #26596 strips markdown link title text to close injection channel
+- **XPIA @mentions**: PR #26589 sanitizes @mentions in `create_issue` body
+- **cache-memory sanitization**: PR #26587 adds pre-agent working-tree sanitization (neutralizes planted executables/disallowed files)
+- **Lock file integrity schema v4**: PR #26594 extends integrity check to detect post-compilation YAML tampering
+
+### 2026-04-16 -- version -- GitHub MCP Server v0.33.0/v0.33.1
+- **v0.33.0** (2026-04-14): Granular PRs/issues toolsets, `resolve_review_thread` tool, `list_commits` path/since/until params, configurable server name/title via translation strings, OSS HTTP logging adapter
+- **v0.33.1** (2026-04-14): Hotfix release
+
+### 2026-04-16 -- feature -- Claude Code Remote Tasks
+- **Remote Tasks** (launched March 20, 2026): Define GitHub repo + prompt + schedule → Claude runs autonomously on Anthropic cloud infrastructure. Supports cron scheduling.
+- **Remote Sessions**: Start task, close laptop, session continues on Anthropic infrastructure
+- **Open-sourced**: Agent layer at `anthropics/claude-code`
+- **v2.1.76** (March 14, 2026): Enhanced MCP elicitation support, improved tool discovery
+
+### 2026-04-16 -- feature -- Copilot Cloud Agent Per-Org Control
+- **Copilot cloud agent per-org control** (April 15, 2026): Can now be enabled for selected organizations via AI Controls page → "Agent" → "Copilot Cloud Agent"
+- **REST API version 2026-03-10**: Available with breaking changes to the REST API
+
 ---
 <!-- Append new entries above this line, newest first -->

.claude/skills/gh-aw-report/references/gh-aw-architecture.md

@@ -64,7 +64,7 @@ Stable architectural facts about the GitHub Agentic Workflows ecosystem. Used by
 - **Plan mode:** Displays step-by-step plan before execution for review
 - **Background delegation:** Prefix prompt with `&` to delegate to cloud coding agent
 - **Specialized sub-agents:** Explore, Task, Code Review, Plan
-- **Model support:** Claude Opus 4.6, Claude Sonnet 4.6, GPT-5.3-Codex, Gemini 3 Pro
+- **Model support:** Claude Opus 4.6, Claude Sonnet 4.6, GPT-5.3-Codex, ~~Gemini 3 Pro~~ (deprecated 2026-03-26)
 - Available to all paid Copilot subscribers (Pro, Business, Enterprise)
 
 ### GitHub Models API
@@ -83,10 +83,24 @@ Stable architectural facts about the GitHub Agentic Workflows ecosystem. Used by
 - **HTTP mode:** Enterprise deployment with per-request OAuth token forwarding
 - **MCP Gateway:** Centralized access management for MCP servers (**v0.2.24** as of 2026-04-18; runs as runner user with uid/gid Docker mapping since v0.2.x)
 
-### Claude Code
-- Anthropic's CLI agentic coding tool
-- Integrates with GitHub via MCP servers
-- Can run gh-aw workflows locally for testing
+## Claude Code (Anthropic)
+
+- Anthropic's CLI agentic coding tool, integrates with GitHub via MCP servers
+- Can serve as the AI engine in gh-aw workflows (alternative to Copilot CLI)
+- **Open-sourced** (2026): Agent layer at `anthropics/claude-code`
+- **Remote Tasks** (launched March 20, 2026): Define a GitHub repo + prompt + cron schedule → Claude runs autonomously on Anthropic's cloud infrastructure; cron scheduling supported
+- **Remote Sessions**: Start a task locally, close laptop; session continues on Anthropic infrastructure
+- Directly comparable to gh-aw scheduled workflows for Claude-engine use cases — a native Anthropic alternative that does not require GitHub Actions
+
+## Companion Projects
+
+| Project | Purpose |
+|---------|---------|
+| `gh-aw-actions` | Shared library of custom GitHub Actions for gh-aw workflows |
+| Agent Workflow Firewall (AWF) | Network egress control for agentic jobs |
+| MCP Gateway | Centralized MCP server access management |
+| `githubnext/agentics` | Sample pack of community gh-aw workflows |
+| `githubnext/awesome-continuous-ai` | Curated list of Continuous AI tools and frameworks |
 
 ## Ecosystem Integrations
 

.github/aw/actions-lock.json

@@ -5,6 +5,11 @@
       "version": "v9",
       "sha": "373c709c69115d41ff229c7e5df9f8788daa9553"
     },
+    "github/gh-aw-actions/setup-cli@v0.68.3": {
+      "repo": "github/gh-aw-actions/setup-cli",
+      "version": "v0.68.3",
+      "sha": "ba90f2186d7ad780ec640f364005fa24e797b360"
+    },
     "github/gh-aw-actions/setup@v0.68.3": {
       "repo": "github/gh-aw-actions/setup",
       "version": "v0.68.3",