test(parity): two-tier audit parity test suite (Fixes #366) [stacked on #365] - #370

Kusari Analysis Results:

✅ No Flagged Issues Detected
All values appear to be within acceptable risk parameters.

Both analyses independently recommend PROCEED. The new dependency claude-agent-sdk@0.2.134 is clean: no advisories, no known vulnerabilities, top scorecard scores (Maintained: 10/10, Code Review: 10/10), MIT licensed, and not deprecated. The minor version lag behind 0.2.137 is a low-risk pinning note only. On the code side, a single medium-severity, low-confidence finding (artipacked) was identified in .github/workflows/parity-tier2.yml at line 50, where actions/checkout does not set persist-credentials: false, leaving the GitHub token stored in .git/config during the run. The risk is substantially mitigated by: the workflow being triggered only via workflow_dispatch (no untrusted PR triggers), environment gating behind parity-tier2 requiring reviewer approval, job permissions scoped to contents: read, and the artifact upload path (parity-artifacts/) excluding the .git directory. As a hardening improvement recommended before merging, adding persist-credentials: false to the Checkout step is advised: '- name: Checkout
uses: actions/checkout@11d5960
with:
persist-credentials: false'. This is not a critical issue but is a simple, low-effort improvement.

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: 195e4a2, performed at: 2026-08-13T20:22:38Z