Merge upstream/master (53 commits) into local

Resolved conflicts:
- ui CompanySettingsSidebar.tsx: keep both Secrets (local) and Cloud upstream (master) nav items
- ui CompanySettingsNav.tsx + test: take master's cloud-upstream/members (drops deprecated `access` tab now consolidated into `members`)
- server plugin-worker-manager.ts: take master's 15min RPC timeout cap
- pnpm-lock.yaml: regenerated via `pnpm install` against merged package.json files

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/shared/src/validators/company-portability.ts

@@ -70,11 +70,11 @@ export const portabilityAgentManifestEntrySchema = z.object({
   capabilities: z.string().nullable(),
   reportsToSlug: z.string().min(1).nullable(),
   adapterType: z.string().min(1),
-  adapterConfig: z.record(z.unknown()),
-  runtimeConfig: z.record(z.unknown()),
-  permissions: z.record(z.unknown()),
+  adapterConfig: z.record(z.string(), z.unknown()),
+  runtimeConfig: z.record(z.string(), z.unknown()),
+  permissions: z.record(z.string(), z.unknown()),
   budgetMonthlyCents: z.number().int().nonnegative(),
-  metadata: z.record(z.unknown()).nullable(),
+  metadata: z.record(z.string(), z.unknown()).nullable(),
 });
 
 export const portabilitySkillManifestEntrySchema = z.object({
@@ -88,7 +88,7 @@ export const portabilitySkillManifestEntrySchema = z.object({
   sourceRef: z.string().nullable(),
   trustLevel: z.string().nullable(),
   compatibility: z.string().nullable(),
-  metadata: z.record(z.unknown()).nullable(),
+  metadata: z.record(z.string(), z.unknown()).nullable(),
   fileInventory: z.array(z.object({
     path: z.string().min(1),
     kind: z.string().min(1),
@@ -105,7 +105,7 @@ export const portabilityProjectManifestEntrySchema = z.object({
   targetDate: z.string().nullable(),
   color: z.string().nullable(),
   status: z.string().nullable(),
-  executionWorkspacePolicy: z.record(z.unknown()).nullable(),
+  executionWorkspacePolicy: z.record(z.string(), z.unknown()).nullable(),
   workspaces: z.array(z.object({
     key: z.string().min(1),
     name: z.string().min(1),
@@ -116,10 +116,10 @@ export const portabilityProjectManifestEntrySchema = z.object({
     visibility: z.string().nullable(),
     setupCommand: z.string().nullable(),
     cleanupCommand: z.string().nullable(),
-    metadata: z.record(z.unknown()).nullable(),
+    metadata: z.record(z.string(), z.unknown()).nullable(),
     isPrimary: z.boolean(),
   })).default([]),
-  metadata: z.record(z.unknown()).nullable(),
+  metadata: z.record(z.string(), z.unknown()).nullable(),
 });
 
 export const portabilityIssueRoutineTriggerManifestEntrySchema = z.object({
@@ -160,15 +160,15 @@ export const portabilityIssueManifestEntrySchema = z.object({
   description: z.string().nullable(),
   recurring: z.boolean().default(false),
   routine: portabilityIssueRoutineManifestEntrySchema.nullable(),
-  legacyRecurrence: z.record(z.unknown()).nullable(),
+  legacyRecurrence: z.record(z.string(), z.unknown()).nullable(),
   status: z.string().nullable(),
   priority: z.string().nullable(),
   labelIds: z.array(z.string().min(1)).default([]),
   billingCode: z.string().nullable(),
-  executionWorkspaceSettings: z.record(z.unknown()).nullable(),
-  assigneeAdapterOverrides: z.record(z.unknown()).nullable(),
+  executionWorkspaceSettings: z.record(z.string(), z.unknown()).nullable(),
+  assigneeAdapterOverrides: z.record(z.string(), z.unknown()).nullable(),
   comments: z.array(portabilityIssueCommentManifestEntrySchema).default([]),
-  metadata: z.record(z.unknown()).nullable(),
+  metadata: z.record(z.string(), z.unknown()).nullable(),
 });
 
 export const portabilityManifestSchema = z.object({
@@ -207,7 +207,7 @@ export const portabilitySourceSchema = z.discriminatedUnion("type", [
   z.object({
     type: z.literal("inline"),
     rootPath: z.string().min(1).optional().nullable(),
-    files: z.record(portabilityFileEntrySchema),
+    files: z.record(z.string(), portabilityFileEntrySchema),
   }),
   z.object({
     type: z.literal("github"),
@@ -262,7 +262,7 @@ export type CompanyPortabilityPreview = z.infer<typeof companyPortabilityPreview
 
 export const portabilityAdapterOverrideSchema = z.object({
   adapterType: z.string().min(1),
-  adapterConfig: z.record(z.unknown()).optional(),
+  adapterConfig: z.record(z.string(), z.unknown()).optional(),
 });
 
 export const companyPortabilityImportSchema = companyPortabilityPreviewSchema.extend({