debug

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The runtime bootstrap (references/support/runtime-bootstrap.mjs) fetches the official manifest from https://github.com/time-attack/gstack/releases/download/${BOOTSTRAP_RELEASE_TAG}/gstack-runtime-manifest.json and then downloads and installs signed runtime artifacts (remote code that can be executed), so this URL is used at runtime to fetch code that may be executed.