Repackages @earendil-works/pi-coding-agent 0.82.0 with brace-expansion 5.0.9 and undici 8.10.0 recorded in its package manifest and npm shrinkwrap, while retaining the upstream MIT license notice. The tarball was verified from a clean consumer with npm install and npm audit --omit=dev (0 vulnerabilities). This supersedes security.2 after GHSA-rgw5-rvv9-x895 and the undici 8.5.0 advisories.