chore(vscode): apply fleet cascade updates

Author: jdalton

.claude/settings.json

@@ -1,7 +1,7 @@
 {
   "// <fleet>": "Managed by socket-wheelhouse; edit the template, then cascade.",
   "// auth": "No apiKeyHelper. Claude Code spawns that runner with neither env nor cwd, so it could never read AI_BALANCER_ENABLED, and a helper that returns nothing renders as 'apiKeyHelper failed: did not return a value' on every launch. The balancer route instead exports ANTHROPIC_API_KEY into CLAUDE_ENV_FILE from the ai-balancer-proxy-start SessionStart hook, which DOES receive the env and so can gate on the flag. Nothing persists in settings, so the claude.ai login is the default and needs no undo.",
-  "// env": "The fleet no-phone-home knobs, one copy per delivery surface. FLEET_ENV (.github/actions/fleet/setup/fleet-env.json) is the source; the shell-rc bridge and the CI workflow env already derive from it, and this block is the third surface — a Claude Code session and every tool it spawns. Kept in lockstep by claude-settings-env-matches-fleet-env.mts, so a knob added there fails this file until it is added here too.",
+  "// env": "The fleet no-phone-home knobs, one copy per delivery surface. FLEET_ENV (.github/actions/fleet/setup/fleet-env.json) is the source; the shell-rc bridge and the CI workflow env already derive from it, and this block is the third surface — a Claude Code session and every tool it spawns. Kept in lockstep by agent/settings-env-matches-fleet-env.mts, so a knob added there fails this file until it is added here too.",
   "env": {
     "AI_BALANCER_ENABLED": "1",
     "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",

.gitattributes

@@ -52,6 +52,7 @@
 .git-hooks/pre-merge-commit linguist-generated=true
 .git-hooks/pre-push linguist-generated=true
 .github/actions/fleet/_shared linguist-generated=true
+.github/actions/fleet/_shared/resolve-external-tool-asset.generated.mjs linguist-generated=true
 .github/actions/fleet/cache-pnpm-store linguist-generated=true
 .github/actions/fleet/checkout linguist-generated=true
 .github/actions/fleet/cleanup-git-signing linguist-generated=true
@@ -79,6 +80,7 @@
 .github/actions/fleet/setup-odai linguist-generated=true
 .github/actions/fleet/setup-rust-cache linguist-generated=true
 .github/actions/fleet/setup-rust-toolchain linguist-generated=true
+.github/actions/fleet/setup/external-tools.generated.json linguist-generated=true
 .github/actions/fleet/upload-artifact linguist-generated=true
 .github/dependabot.yml linguist-generated=true
 .github/local-ci.Dockerfile linguist-generated=true
@@ -100,6 +102,7 @@ docs/design/fleet/README.md linguist-generated=true
 docs/design/fleet/components.css linguist-generated=true
 docs/design/fleet/tokens.css linguist-generated=true
 docs/fleet/agents.md linguist-generated=true
+docs/fleet/ai linguist-generated=true
 docs/fleet/ai-balancer linguist-generated=true
 docs/fleet/ai-balancer.md linguist-generated=true
 docs/fleet/development linguist-generated=true
@@ -125,14 +128,14 @@ test/fleet/common/fixture linguist-generated=true
 test/fleet/e2e/comment-voice.test.mts linguist-generated=true
 test/fleet/integration/comment-voice.test.mts linguist-generated=true
 test/fleet/nock-loopback-passthrough.test.mts linguist-generated=true
-test/fleet/registry-infra/cargo/placeholder.test.mts linguist-generated=true
-test/fleet/registry-infra/npm/placeholder.test.mts linguist-generated=true
 test/fleet/scripts/setup.mts linguist-generated=true
 test/fleet/unit/ci/gates/run.test.mts linguist-generated=true
 test/fleet/unit/comment-voice.test.mts linguist-generated=true
 test/fleet/unit/fix/plan.test.mts linguist-generated=true
 test/fleet/unit/fix/run.test.mts linguist-generated=true
 test/fleet/unit/lockstep/emit-mirror-globs.test.mts linguist-generated=true
+test/fleet/unit/registry-infra/cargo/placeholder.test.mts linguist-generated=true
+test/fleet/unit/registry-infra/npm/placeholder.test.mts linguist-generated=true
 *.patch whitespace=-blank-at-eol,-space-before-tab
 # </fleet>
 # <repo>

.github/workflows/ci-fix.yml

@@ -11,6 +11,7 @@ on:
         default: ''
 
 permissions:
+  actions: read
   contents: read
 
 concurrency:

.github/workflows/ci-gates.yml

@@ -63,8 +63,8 @@ jobs:
           # shallow clone rather than false-green.
           checkout-fetch-depth: '0'
           socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
-          payload-token-client-id: ${{ vars.SOCKET_PR_CLIENT_ID }}
-          payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}
+          payload-token-client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID || vars.SOCKET_RELEASE_CLIENT_ID }}
+          payload-token-private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}
       - name: Check repository
         uses: ./.github/actions/fleet/run-script
         with:
@@ -106,8 +106,8 @@ jobs:
         uses: ./.github/actions/fleet/setup-and-install
         with:
           socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
-          payload-token-client-id: ${{ vars.SOCKET_PR_CLIENT_ID }}
-          payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}
+          payload-token-client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID || vars.SOCKET_RELEASE_CLIENT_ID }}
+          payload-token-private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}
       - name: Build and test
         uses: ./.github/actions/fleet/run-script
         with:
@@ -150,8 +150,8 @@ jobs:
         uses: ./.github/actions/fleet/setup-and-install
         with:
           socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
-          payload-token-client-id: ${{ vars.SOCKET_PR_CLIENT_ID }}
-          payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}
+          payload-token-client-id: ${{ secrets.SOCKET_RELEASE_CLIENT_ID || vars.SOCKET_RELEASE_CLIENT_ID }}
+          payload-token-private-key: ${{ secrets.SOCKET_RELEASE_APP_PRIVATE_KEY }}
       - name: Build and test
         uses: ./.github/actions/fleet/run-script
         with: