Review fixes R1–R10 + G6: Security, infra, tooling, CI, agent edit endpoint #2

	name: CI

	on:
	pull_request:
	push:
	branches: [main]

	permissions:
	contents: read

	jobs:
	lint:
	name: Lint (ruff)
	runs-on: ubuntu-latest
	# Pre-existing lint issues: set to false once codebase is clean
	continue-on-error: true
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-python@v5
	with:
	python-version: "3.11"

	- name: Install ruff
	run: pip install ruff

	- name: ruff check
	run: ruff check functions/ layers/ apps/ marvain_cli/ tests/

	- name: ruff format check
	run: ruff format --check functions/ layers/ apps/ marvain_cli/ tests/

	test:
	name: Tests (pytest)
	runs-on: ubuntu-latest
	env:
	PYTHONPATH: layers/shared/python
	HTTPS_ENABLED: "false"
	AWS_DEFAULT_REGION: us-east-1

	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-python@v5
	with:
	python-version: "3.11"

	- name: Install dependencies
	run: \|
	pip install --upgrade pip
	pip install \
	boto3 \
	fastapi \
	mangum \
	uvicorn \
	jinja2 \
	requests \
	httpx \
	python-multipart \
	python-dateutil \
	python-jose[cryptography] \
	itsdangerous \
	websockets \
	python-dotenv \
	pyyaml \
	typer \
	click \
	pytest \
	pytest-cov

	- name: Run tests
	run: python -m pytest tests/ -q --tb=short

Provide feedback