Clean merge fix

[gztensor]

Description

This PR propagates all recent hotfixes to devnet-ready

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Other (please describe): maintenance

Checklist

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have run ./scripts/fix_rust.sh to ensure my code is formatted and linted correctly
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[github-actions]

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

[github-actions]

🛡️ AI Review — Skeptic (security review)

VERDICT: VULNERABLE

BASELINE scrutiny: gztensor has write permission and substantial repo history; branch is chore/clean-merges-fix-2026-07-01 -> main.

Findings

Sev	File	Finding
HIGH	PR metadata / PR body	Direct-to-main PR is not justified as a hotfix or deployment	(off-diff)
HIGH	.github/actions/try-runtime/action.yml:40	CI executes an unauthenticated downloaded binary	inline

Other findings

• [HIGH] Direct-to-main PR is not justified as a hotfix or deployment (PR metadata / PR body) — The PR targets main from chore/clean-merges-fix-2026-07-01, not from testnet, and the body says it propagates hotfixes to devnet-ready rather than explaining why this should merge directly into main. The branch policy requires direct-to-main PRs to be explicit hotfixes or deployment PRs; this needs a concrete main-target justification or retargeting to the proper branch.

Conclusion

The runtime diff does not show an obvious malicious backdoor, but this PR violates the main-branch flow without an explicit hotfix/deployment justification and adds an unauthenticated CI binary execution path. Those are blocking security-process/supply-chain risks.

---

# 🔍 AI Review — Auditor (domain review) has not yet run on this PR.

[github-actions]

🔄 AI review updated — Skeptic: VULNERABLE