The standalone dl.google.com entry in network.allowed is fully
covered by the java ecosystem identifier, which already includes
Google's Android/JDK distribution mirrors. Using the identifier
keeps the allowlist maintainable as Google's download host layout
shifts.
Refreshed regenerated artifacts from `gh aw compile`
(compiler v0.82.13 -> v0.83.4):
- .github/workflows/repo-assist.lock.yml
- .github/aw/actions-lock.json
- .github/workflows/agentics-maintenance.yml
- .github/skills/agentic-workflows/SKILL.md
The compile pass also normalises repo-assist.md itself: the model
field moves out of the engine block into a top-level `model:`, and
the redundant nested model under safe-outputs.threat-detection
is dropped.