agent-sh/agnix v0.48.1 on GitHub

Tool release and spec baselines (#1354). Advanced the tracked releases for
Claude Code (v2.1.226 to v2.1.229), OpenCode (v1.18.15 to v1.18.17),
Kiro CLI (2.16.0 to 2.17.0), Cline (v4.1.6 to v4.1.8), Cursor
(3.15.6 to 3.15.19), Gemini CLI (v0.54.4 to v0.55.1), and amp (news
marker size-the-orbs-of-production to global-plugins-and-skills), plus the
cursor-environment spec hash. Registered the output_style, gemini_agent,
and per-client skill validators in the tool inventory and filled in the
matching config surfaces and rule prefixes (CC-OS, MCP, OC-SK, CR-SK,
GM-AG) in knowledge-base/RESEARCH-TRACKING.md. Watcher bookkeeping only -
no validation behaviour changes.

Skill directory size exclusions (#1360). AS-015 now omits paths matched
by top-level exclude or [files].exclude when calculating the 8 MB skill
directory total, while continuing to validate the rest of the skill.
CC-MEM-001 false positive when several paths are passed on the command
line (#1368). The
workspace root came from the parent of the first path, so a file in a
subdirectory listed first became the root and CLAUDE.md's root-relative
@imports were reported as escaping the project. Since pre-commit passes
matched files in sorted order, .claude/... sorted ahead of CLAUDE.md and
the same tree passed or failed depending on argument order. The root is now
the deepest common ancestor of every path, walked up to the nearest .git or
.agnix.toml marker, so results no longer depend on argument order or on
which files a commit happens to touch.
Linux x86_64 release binary unusable on glibc older than 2.39
(#1371). The x86_64 gnu
build ran natively on ubuntu-latest, so it linked the runner's glibc and
failed at load time with version 'GLIBC_2.39' not found on Debian bookworm,
RHEL/Rocky 9, and Ubuntu 22.04. Both gnu targets now build through cross
against an old sysroot (currently GLIBC_2.18), a release gate fails the
build if any binary needs newer than GLIBC_2.31, and npm install -g agnix
plus scripts/download.sh probe the downloaded binary and retry with the
static musl archive when the host cannot load it.

Dependency lockfile bumps (website + VS Code extension): js-yaml
GHSA-5p4m-2wfm-xmqj (quadratic !!omap complexity) and nanoid
GHSA-2v37-7h3g-55p8 (zero-size generator loop). Lockfile-only; no manifest
range changes.