- CHANGELOG: complete the [3.8.30] section to 1:1 coverage of all 70 commits
since v3.8.29 (Features/Changed/Fixed/Tests/Maintenance/Security/Dependencies).
- security: cherry-pick the DDG-lite scraper sanitization hardening from #4356
(closes 4 HIGH CodeQL alerts: js/double-escaping, js/incomplete-multi-character-
sanitization, js/incomplete-url-substring-sanitization x2).
- docs: ANTHROPIC_AUTH_TOKEN (not the bare AUTH_TOKEN shorthand) in the Claude Code
guide; allowlist GEMINI_API_KEY/GOOGLE_GEMINI_BASE_URL (Gemini CLI vars) in the
fabricated-docs checker — fixes the docs-sync-strict gate.