ecto - chore: sync defense-in-depth files from agentic

[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing and Code of Conduct guidelines.
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.
  • Copied bootstrap script and prose; no library source changed. Existing suite passes at 100% coverage (239 tests).

What kind of change does this PR introduce?

Chore — sync defense-in-depth copies from jaredwray/agentic.

Summary

Refresh the stale Safe Chain bootstrap script and append the missing Pull requests section from the agentic AGENTS.md template. DEFENSE_IN_DEPTH.md is unchanged; its catalog is behind upstream and belongs to defense-in-depth-nodejs.

Changes

• scripts/setup-cloud-environment.sh replaced with upstream at 0506fb922922f594e359d9cc357b76fa10ebbb9d (agentic main b0bd68459cd2cbf359cb73fad872fef216e52965)
• AGENTS.md Pull requests section appended from upstream at 18ca132c078558ad9a5fbbaf10d958537fb3e954

Verification

• bash -n scripts/setup-cloud-environment.sh
• pnpm test passes — 239 tests, 100% coverage
• GitHub Actions CI green — tests on Node 22/24/26, code-coverage, CodeQL, zizmor, Socket, Codecov

  

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (e0a1688) to head (a9cac1a).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #416   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            9         9           
  Lines          406       406           
  Branches        94        94           
=========================================
  Hits           406       406           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-26T08:01:16.378508Z	a9cac1a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a9cac1aba1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Ignore blocking placeholders when probing for pnpm

When a Claude setup attempt exits before Corepack can provision pnpm, it leaves this script's blocking pnpm stub on the persisted CLAUDE_ENV_FILE path. On a later retry after Corepack becomes available, command -v pnpm resolves that stub, so both this fallback and the missing-pnpm check are skipped; Safe Chain consequently has no real pnpm to wrap and the final verification/install still fails. Detect and ignore the placeholder while preserving the required shim-first ordering.

AGENTS.md reference: AGENTS.md:L58-L59

Useful? React with 👍 / 👎.