fix(strix): preserve complete support and Rust scopes

[seonghobae]

Summary

• avoid injecting a partial backend application context for backend/scripts and backend/tests pull-request targets
• include changed Rust sources in the bounded PR-head Strix scope so Tauri and native security boundaries are reviewed with their frontend callers
• preserve existing full-head Docker handling and broad backend application scoping
• align the setup-python action pin contract with the current workflow
• update Strix pins to aiohttp 3.14.3 and cryptography 50.0.0 with regenerated hashes

Why

Naruon PR #1239 changed only a backend script, its tests, and documentation. The static application context omitted real backend modules and produced false missing-import findings. DiskSage PR #125 exposed the complementary native-code gap: its changed TypeScript IPC wrapper was scanned alone while four changed Rust enforcement modules were omitted, producing conditional findings that contradicted the authoritative backend path, approval, digest, and model-integrity checks.

This keeps fail-closed Strix enforcement while preventing support-code scans from receiving a misleading partial runtime tree and ensuring changed Rust security boundaries are present as non-executable PR-head data.

The first dependency-review run also exposed newly published vulnerabilities in the existing Strix dependency set. The updated versions satisfy the official patched-version boundaries; all 106 locked packages passed pip-audit on the prior exact head.

Validation

• focused Rust PR-head scope regression: passed on a96a725
• bash -n scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh: passed
• git diff --check: passed
• CodeGraph sync: passed
• full local Strix gate suite on the new head was stopped after a long silent run and is not claimed as passed; same-head GitHub Checks are running
• prior exact head b76c0d0: all GitHub Checks passed, including pip-audit with no known vulnerabilities across 106 locked packages

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 48 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3a483036-4970-4bd4-9fb1-de67340d65c9

📥 Commits

Reviewing files that changed from the base of the PR and between 3f65dbe and a96a725.

📒 Files selected for processing (4)

• requirements-strix-ci-hashes.txt
• requirements-strix-ci.txt
• scripts/ci/strix_quick_gate.sh
• scripts/ci/test_strix_quick_gate.sh

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent @cwl-noema-review Please perform an independent exact-current-head review of a96a72562eabdec1020f2d5e6745d5d4dc79c21b. Review the Strix scope boundary, changed-Rust inclusion, dependency-lock consistency, and fail-closed behavior; approve only if no actionable issue remains.