fix(security): complete dependency confusion fix — all pip install agent-os replaced (#328)

* docs: add testing guide for external testers and customers

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: add regulatory alignment table and Purview positioning to README

Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with
AGT coverage mapping. Reference Microsoft Purview DSPM for AI as
complementary data governance layer.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): restore read-all at workflow level for Scorecard verification

The Scorecard API rejects workflows with write permissions at the
workflow level. id-token: write and security-events: write must be
scoped to the job level only. Restores permissions: read-all at
workflow level while keeping job-level write permissions intact.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: add comprehensive docstrings to mcp_adapter.py classes (#324)

Add Google-style docstrings with Args, Returns, Raises, Attributes,
and Example sections to MCPMessageType, MCPAdapter, and MCPServer
classes. Also enhances docstrings for key methods including
handle_message, _handle_tools_call, _handle_resources_read, and
_map_tool_to_action.

Fixes #316

* ci: add markdown link checker workflow (#323)

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>

* feat: add policy evaluation heatmap to SRE dashboard (#309) (#326)

* fix: remove unregistered PyPI packages from notebooks and requirements (dependency confusion) (#325)

- Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks;
  agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector
- Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs)
  in customer-service/requirements.txt
- Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib
  and hashlib-compat is not a real PyPI package

* fix(security): complete dependency confusion fix — replace all pip install agent-os with agent-os-kernel

Replace all remaining instances of `pip install agent-os` (unregistered
on PyPI) with `pip install agent-os-kernel` (the actual package) across
docs, examples, TypeScript extensions, CLI source, tests, and SVG assets.

Also fixes `pip install emk` references to point to `agent-os-kernel[full]`
since emk is a submodule, not a standalone PyPI package.

Completes the fix started in PR #325 which only covered notebooks.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Parsa Faraji Alamouti <165321600+parsa-faraji@users.noreply.github.com>
Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com>
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: Zeel Desai <72783325+zeel2104@users.noreply.github.com>
Co-authored-by: Xavier Garceau-Aranda <xavier.garceau-aranda@posteo.net>

Author: 6 people