73836d9c8f
shell sandbox: double-umount + remount /proc to prevent exfiltration when agent peels off --mount-proc overlay. webhooks: filter check_suite.pull_requests to same-repo PRs only (excludes cross-fork sync PRs) and skip merged/closed PRs. Co-authored-by: Cursor <cursoragent@cursor.com>