* upstream/main: (29 commits)
  style: use module-level re import instead of local import re as _re
  Preserve numeric credential labels in auth removal
  Honor provider reset windows in pooled credential failover
  docs: update docstring to mention Fireworks strict validation
  test: add strict API validation tests for Fireworks compatibility
  test: add test for _should_sanitize_tool_calls()
  refactor: use _should_sanitize_tool_calls in run_conversation()
  refactor: use _should_sanitize_tool_calls in _handle_max_iterations()
  refactor: use _should_sanitize_tool_calls in flush_memories()
  feat: add _should_sanitize_tool_calls() method
  test(redact): add regression tests for lowercase variable redaction (NousResearch#4367) (NousResearch#5185)
  docs(skill): claude-code v2.2 — add cheat sheet commands, env vars, rules, advanced features (NousResearch#5158)
  fix(telegram): prevent duplicate message delivery on send timeout (NousResearch#5153)
  fix: strip MEDIA: directives from streamed gateway messages (NousResearch#5152)
  docs(skill): comprehensive claude-code skill rewrite v2.0 (NousResearch#5155)
  fix(security): guard cron script against path traversal and redact output
  feat: add exit code context for common CLI tools in terminal results (NousResearch#5144)
  fix: move pre_llm_call plugin context to user message, preserve prompt cache (NousResearch#5146)
  fix: --yolo and other flags silently dropped when placed before 'chat' subcommand (NousResearch#5145)
  fix: include approval metadata in terminal tool results (NousResearch#5141)
  ...

…ousResearch#4367) (NousResearch#5185)

Add 5 regression tests from PR NousResearch#4476 (gnanam1990) to prevent re-introducing
the IGNORECASE bug that caused lowercase Python/TypeScript variable assignments
to be incorrectly redacted as secrets. The core fix landed in 6367e1c.

Tests cover:
- Lowercase Python variable with 'token' in name
- Lowercase Python variable with 'api_key' in name
- TypeScript 'await' not treated as secret value
- TypeScript 'secret' variable assignment
- 'export' prefix preserved for uppercase env vars

Co-authored-by: gnanam1990 <gnanam1990@users.noreply.github.com>

…ousResearch#4367) (NousResearch#5185)

Add 5 regression tests from PR NousResearch#4476 (gnanam1990) to prevent re-introducing
the IGNORECASE bug that caused lowercase Python/TypeScript variable assignments
to be incorrectly redacted as secrets. The core fix landed in 332c115.

Tests cover:
- Lowercase Python variable with 'token' in name
- Lowercase Python variable with 'api_key' in name
- TypeScript 'await' not treated as secret value
- TypeScript 'secret' variable assignment
- 'export' prefix preserved for uppercase env vars

Co-authored-by: gnanam1990 <gnanam1990@users.noreply.github.com>

…ousResearch#4367) (NousResearch#5185)

Add 5 regression tests from PR NousResearch#4476 (gnanam1990) to prevent re-introducing
the IGNORECASE bug that caused lowercase Python/TypeScript variable assignments
to be incorrectly redacted as secrets. The core fix landed in 6367e1c.

Tests cover:
- Lowercase Python variable with 'token' in name
- Lowercase Python variable with 'api_key' in name
- TypeScript 'await' not treated as secret value
- TypeScript 'secret' variable assignment
- 'export' prefix preserved for uppercase env vars

Co-authored-by: gnanam1990 <gnanam1990@users.noreply.github.com>

…ousResearch#4367) (NousResearch#5185)

Add 5 regression tests from PR NousResearch#4476 (gnanam1990) to prevent re-introducing
the IGNORECASE bug that caused lowercase Python/TypeScript variable assignments
to be incorrectly redacted as secrets. The core fix landed in 80522ed.

Tests cover:
- Lowercase Python variable with 'token' in name
- Lowercase Python variable with 'api_key' in name
- TypeScript 'await' not treated as secret value
- TypeScript 'secret' variable assignment
- 'export' prefix preserved for uppercase env vars

Co-authored-by: gnanam1990 <gnanam1990@users.noreply.github.com>

…ousResearch#4367) (NousResearch#5185)

Add 5 regression tests from PR NousResearch#4476 (gnanam1990) to prevent re-introducing
the IGNORECASE bug that caused lowercase Python/TypeScript variable assignments
to be incorrectly redacted as secrets. The core fix landed in 6367e1c.

Tests cover:
- Lowercase Python variable with 'token' in name
- Lowercase Python variable with 'api_key' in name
- TypeScript 'await' not treated as secret value
- TypeScript 'secret' variable assignment
- 'export' prefix preserved for uppercase env vars

Co-authored-by: gnanam1990 <gnanam1990@users.noreply.github.com>

…ousResearch#4367) (NousResearch#5185)

Add 5 regression tests from PR NousResearch#4476 (gnanam1990) to prevent re-introducing
the IGNORECASE bug that caused lowercase Python/TypeScript variable assignments
to be incorrectly redacted as secrets. The core fix landed in 454d48b.

Tests cover:
- Lowercase Python variable with 'token' in name
- Lowercase Python variable with 'api_key' in name
- TypeScript 'await' not treated as secret value
- TypeScript 'secret' variable assignment
- 'export' prefix preserved for uppercase env vars

Co-authored-by: gnanam1990 <gnanam1990@users.noreply.github.com>