Fixed
- Intent scripts that unlock or open something now ask for the Critical Action PIN (#779). Home Assistant gives the agent a tool for each intent script, and the PIN check never looked at what it ran, so an intent script whose action unlocked the front door or opened the garage ran with no PIN when the agent called it. Its action is now checked the way a script's steps are: one that unlocks a door asks for the PIN, one that turns on a light does not, and one whose target the model fills in, or whose action cannot be read, is held.
This is a safety hotfix on top of 3.44.5; it contains nothing else. Field-tested: an intent script whose action unlocks a lock asks for the PIN when the agent runs it, and a wrong PIN leaves it undone.
Still open: automations started by other state changes the agent makes, such as an input boolean (#814).