Merge remote-tracking branch 'origin/main' into capy/fw3-a1

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

# Conflicts:
#	scripts/harness-version.json

scripts/harness-version.json

@@ -16,7 +16,7 @@
     "scripts/lib/published-text.ts": {"blob":"3f2e4d616b5dd0204035710c66b64d49055c5714","since":5},
     "scripts/lib/shard-engine.ts": {"blob":"3cd0b1aaa84018b00bf9ea0ce48093f3c8492f66","since":5},
     "scripts/test-paid-shards.ts": {"blob":"8ddee5f11ed7856876135520dd8025ab989e2db9","since":5},
-    "scripts/test-pr-profile.ts": {"blob":"52c325e1811de7b59e231bbef755f932380abeac","since":5,"nonBehavioral":"PR selection only: shebang and per-extension import scanning, fail-closed scan errors, six free-only repository-config files, capy/ derivable, and the full-gate fallback label; it changes which cases a PR runs, never how any case is judged, so no verdict can change"},
+    "scripts/test-pr-profile.ts": {"blob":"64cd7acfc0f2a4f53472bbdc8a50216984230c5a","since":5,"nonBehavioral":"PR selection only (A1 merged with #3253's free-only entry): shebang and per-extension import scanning, fail-closed scan errors, free-only repository-config files, capy/ derivable, the full-gate fallback label; it changes which cases a PR runs, never how any case is judged"},
     "scripts/test-strict-output.ts": {"blob":"01185d20dc9761b04b9b2f751ec98664fe0eaf93","since":5},
     "test/helpers/agent-sdk-runner.ts": {"blob":"210bba92d241a90df578b2c7fc943ac5755d0025","since":5},
     "test/helpers/auq-substance-panel.ts": {"blob":"4881260ef793668e4963a062db6d06a5e1f7a40f","since":5},

scripts/test-pr-profile.ts

@@ -236,6 +236,7 @@ export const FREE_ONLY_PR_FILES = [
   '.github/workflows/cso-runtime-qualification.yml',
   '.github/workflows/cso-scanner-images.yml',
   '.github/workflows/dependency-review.yml',
+  '.github/workflows/free-durations-record.yml',
   '.github/workflows/free-tests.yml',
   '.github/workflows/make-pdf-gate.yml',
   '.github/workflows/model-policy-freshness.yml',