Bump claude-agent-sdk floor to >=0.2.129 (allowedTools-injection security fix) and verify fleet envs pick it up

[olegbrok]

Source: claude-agent-sdk-python v0.2.129 (released 2026-08-04).

What changed upstream:

• Security fix: skill names from ClaudeAgentOptions(skills=[...]) were passed unchecked into the CLI's --allowedTools value (which splits on commas/spaces) — a crafted name could inject extra permission rules. The transport now validates and rejects malformed names (#1145 upstream).
• Breaking change: strict skill-name validation raises ValueError at connect for names with parens/commas/wildcards/leading-//whitespace.
• Bundles CLI 2.1.221 (itself carrying a zsh [[ ]] permission-bypass fix).

PinkyBot impact:

• We do NOT use ClaudeAgentOptions.skills (streaming_session.py:455 passes allowed_tools/disallowed_tools/mcp_servers only; skills are delivered as on-disk SKILL.md) → the breaking change is a no-op, upgrade is safe.
• We DO want the hardened transport: our allowed_tools lists ride the same --allowedTools wire, and defense-in-depth on that path is cheap.
• Current pin claude-agent-sdk>=0.2.127,<0.3 already admits 0.2.129, but a satisfied-but-stale env sits silently (the Mini ran 0.1.81 until today — task Upgrade claude-agent-sdk 0.1.81 → 0.2.x (breaking, includes CLI 2.1.142 fixes) #508 / PR fix(admin): fall back from broken venv pip #995 territory).

Proposed changes:

1. pyproject: raise floor to claude-agent-sdk>=0.2.129,<0.3 so drift detection (_check_installed_deps_drift) flags any env below the security fix.
2. After tonight's Mini 26.08.006 bounce (first deploy with the fix(admin): fall back from broken venv pip #995 deps repair), verify claude_agent_sdk.__version__ >= 0.2.129 in the daemon env; same check on Pi/TOD at their next windows.
3. (Optional hardening, same spirit as upstream #1145) validate create_skill names at registration — lowercase-hyphen only is documented but unenforced, and skill names become filesystem path components.

🤖 Opened by Barsik

[olegbrok]

Fixed by PR #997 (squash on main). Floor now >=0.2.129; drift detection flags any env below the security fix. Deployment note: NOT in a release yet — rides the next natural cut after tonight's 26.08.006 validation; the fixed Mini deps step (#995) installs 0.2.129 tonight regardless since the old pin range already admitted it.

🤖 Closed by Barsik