chore: merge unstable into epbs (CI check only, do not squash)

.github/custom/local-testnet/params.yaml

@@ -3,7 +3,9 @@ network:
   - el_type: geth
     el_image: ethereum/client-go:v1.16.8
     cl_type: lighthouse
-    cl_image: sigp/lighthouse:v8.2.0
+    # Must be >= v8.2.0: the lighthouse VC code Anchor builds on now requests proposer duties
+    # from /eth/v2/validator/duties/proposer, which older beacon nodes reject with a 400.
+    cl_image: sigp/lighthouse:v8.2.1
     validator_count: 32
     count: 2
     supernode: true

.github/prompts/review.md

@@ -20,5 +20,7 @@ Do NOT comment on:
 
 When you DO find issues:
 - Use inline comments with concrete fix suggestions
+- Post each inline comment as soon as the issue is confirmed; do not save
+  them all up for the end of the review
 - Post a brief summary comment ONLY listing the issues found
 - No preamble, no praise, no filler

.github/workflows/claude-mentions.yml

@@ -83,14 +83,14 @@ jobs:
 
             - name: Run Claude Code Action
               if: steps.check.outputs.is_member == 'true'
-              timeout-minutes: 15
+              timeout-minutes: 25
               uses: anthropics/claude-code-action@v1.0.127
               with:
                   github_token: ${{ steps.app-token.outputs.token }}
                   use_bedrock: "true"
                   claude_args: |
-                      --max-turns 50
-                      --model us.anthropic.claude-opus-4-7
+                      --max-turns 80
+                      --model us.anthropic.claude-opus-4-8
                       --allowedTools "Glob,Grep,LS,Read,mcp__github_comment__update_claude_comment,mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__get_workflow_run_details,mcp__github_ci__download_job_log,Bash(git status:*),Bash(git diff:*),Bash(git show:*),Bash(git log:*),Bash(git rev-parse:*),Bash(git merge-base:*),Bash(git grep:*)"
                       --disallowedTools "Edit,MultiEdit,Write,NotebookEdit,Bash(git add:*),Bash(git commit:*),Bash(git rm:*)"
                       --append-system-prompt "${{ steps.review-prompt.outputs.content }}"

.github/workflows/claude-pr-review.yml

@@ -80,6 +80,9 @@ jobs:
               with:
                   token: ${{ steps.app-token.outputs.token }}
                   ref: ${{ github.event.pull_request.head.sha }}
+                  # Fork PR checkout is gated on the is_member check above,
+                  # so only org members' code ever reaches this step.
+                  allow-unsafe-pr-checkout: true
 
             - name: Configure AWS Credentials (OIDC)
               if: steps.check.outputs.is_member == 'true'
@@ -102,9 +105,20 @@ jobs:
                     echo "PROMPT_EOF"
                   } >> "$GITHUB_OUTPUT"
 
+            # Save the diff to a file the agent can page through with Read.
+            # Reading it via `gh pr diff` wastes agent turns: large diffs
+            # overflow the tool-output limit and the tight tool allowlist
+            # blocks saving the output to a file.
+            - name: Save PR diff
+              if: steps.check.outputs.is_member == 'true'
+              run: |
+                  gh pr diff ${{ github.event.pull_request.number }} --repo ${{ github.repository }} > "${GITHUB_WORKSPACE}/.claude-pr-diff.txt"
+              env:
+                  GH_TOKEN: ${{ github.token }}
+
             - name: Run Claude Code Action
               if: steps.check.outputs.is_member == 'true'
-              timeout-minutes: 15
+              timeout-minutes: 25
               env:
                   ACTIONS_STEP_DEBUG: true
               uses: anthropics/claude-code-action@v1.0.127
@@ -115,6 +129,10 @@ jobs:
                       REPO: ${{ github.repository }}
                       PR NUMBER: ${{ github.event.pull_request.number }}
 
+                      The full unified diff of this PR is saved at .claude-pr-diff.txt in
+                      the repository root. Read it with the Read tool (use offset/limit to
+                      page through large diffs) instead of running `gh pr diff`.
+
                       You are an automated silent watchdog reviewer. Your job is to catch
                       real problems — NOT to provide a comprehensive review or commentary.
 
@@ -125,8 +143,8 @@ jobs:
 
                       ${{ steps.review-prompt.outputs.content }}
                   claude_args: |
-                      --max-turns 50
-                      --model us.anthropic.claude-opus-4-7
+                      --max-turns 80
+                      --model us.anthropic.claude-opus-4-8
                       --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Read,Grep,Bash(git status:*),Bash(git diff:*),Bash(git show:*),Bash(git log:*),Bash(git rev-parse:*),Bash(git merge-base:*),Bash(git grep:*)"
 
             - name: Remove claude-recheck label if present

.github/workflows/local-testnet.yml

@@ -47,9 +47,17 @@ jobs:
 
       - name: Install Kurtosis
         run: |
-          KURTOSIS_VERSION=$(curl -s https://api.github.com/repos/kurtosis-tech/kurtosis-cli-release-artifacts/releases/latest | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/')
+          set -euo pipefail
+          # Resolve the latest tag from the github.com redirect rather than api.github.com.
+          # The REST API allows 60 unauthenticated requests/hour per IP and the shared runner
+          # egress IPs exhaust it, which silently yielded an empty version and broke the job.
+          KURTOSIS_VERSION=$(curl -fsSLI -o /dev/null -w '%{url_effective}' --retry 3 --retry-all-errors \
+            https://github.com/kurtosis-tech/kurtosis-cli-release-artifacts/releases/latest | sed 's#.*/tag/##')
+          case "${KURTOSIS_VERSION}" in
+            ''|*/*) echo "::error::Could not resolve latest Kurtosis version (got '${KURTOSIS_VERSION}')"; exit 1 ;;
+          esac
           echo "Installing Kurtosis version: ${KURTOSIS_VERSION}"
-          curl -L "https://github.com/kurtosis-tech/kurtosis-cli-release-artifacts/releases/download/${KURTOSIS_VERSION}/kurtosis-cli_${KURTOSIS_VERSION}_linux_amd64.tar.gz" -o kurtosis.tar.gz
+          curl -fL --retry 3 --retry-all-errors "https://github.com/kurtosis-tech/kurtosis-cli-release-artifacts/releases/download/${KURTOSIS_VERSION}/kurtosis-cli_${KURTOSIS_VERSION}_linux_amd64.tar.gz" -o kurtosis.tar.gz
           tar -xzf kurtosis.tar.gz
           sudo mv kurtosis /usr/local/bin/
           sudo chmod +x /usr/local/bin/kurtosis