* feat(ci): onboard ag-grid to the JIRA/GHA agent pipeline

Add .github/workflows/jira-agent-pipeline.yml (thin consumer stub, channel
latest), a ci.yml pr_preview job that builds + publishes per-PR UMD bundles to
gh-pages via the shared pr-preview-publish action, and pr-cleanup.yml. Open the
draft-PR CI gates (init/build/docs/summary) for the agent's ghabot-ag-* branches
so the pipeline's draft PRs run real CI and the green-CI handback + ci-failure
loops fire.

Consumes the shared install-ag-dev-prompts / pr-preview-publish /
pr-preview-cleanup actions from external/ag-shared (pulled in a separate commit).

Part of the JIRA/GHA agent-pipeline rollout (AG-17085) / ag-grid onboarding.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* git subrepo pull external/ag-shared

subrepo:
  subdir:   "external/ag-shared"
  merged:   "37af63f0ed0"
upstream:
  origin:   "https://github.com/ag-grid/ag-shared.git"
  branch:   "latest"
  commit:   "ed19ad192f9"
git-subrepo:
  version:  "0.4.9"
  origin:   "https://github.com/Homebrew/brew"
  commit:   "c3542bb62f"

* fix(ci): address Codex review — pin pr-preview actions to trusted base ref

- pr_preview / pr-cleanup: check out the PR's base (trusted) ref rather than the
  default pull_request ref, so the local shared action is not PR-controlled code
  executed with a contents:write token (and resolves reliably on closed PRs).
  hashFiles() guards self-bootstrap the action's first landing on the base branch.
- Note that ag-grid UMD builds with sourcemap:false, so no .map files are
  published (the shared action's optional .map copy is a no-op here).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* git subrepo pull external/ag-shared

subrepo:
  subdir:   "external/ag-shared"
  merged:   "080092b019d"
upstream:
  origin:   "https://github.com/ag-grid/ag-shared.git"
  branch:   "latest"
  commit:   "95d822747b2"
git-subrepo:
  version:  "0.4.9"
  origin:   "https://github.com/Homebrew/brew"
  commit:   "c3542bb62f"

* fix(ci): use the repo's same-repo PR gate for pr-preview (consistent guard)

Replace the bespoke base-ref checkout + hashFiles guards with the established
untrusted-PR convention already used across ci.yml / pr-review.yml: gate the
write-needing pr_preview and gh_pages_cleanup jobs to same-repo PRs
(head.repo.full_name == github.repository) with a plain checkout. Adds the
same-repo gate to the new gh_pages_cleanup job.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(ci): trim verbose comments in pr-preview / pr-cleanup workflows

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* git subrepo pull external/ag-shared

subrepo:
  subdir:   "external/ag-shared"
  merged:   "5722e25ded5"
upstream:
  origin:   "https://github.com/ag-grid/ag-shared.git"
  branch:   "latest"
  commit:   "9e1703a138d"
git-subrepo:
  version:  "0.4.9"
  origin:   "https://github.com/Homebrew/brew"
  commit:   "c3542bb62f"

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…elects: 'descendants' (#13960)

* AG-17267 Forward browser event through group selection descendants path

When clicking a group row with groupSelects: 'descendants', the
rowSelected event's `event` property was null for descendant and
parent-group nodes. Thread the browser Event through selectChildren()
and updateGroupsFromChildrenSelections() so every rowSelected event
carries the originating click.

* Polish: strip explainer comments from test, use destructuring

…true (#13992)

* AG-17509 Fix header row gaining tabindex when suppressHeaderFocus is true

AG-15523 unconditionally set tabindex on the header row element, causing
it to appear in the browser tab order even when suppressHeaderFocus is
true. Guard the tabindex so it is only set when header focus is not
suppressed, and update the behavioural test to assert the attribute is
absent.

* AG-17509 Use shared _isHeaderFocusSuppressed helper in React header row

Address review feedback: export _isHeaderFocusSuppressed from
main-internal and use it in the React renderer for parity with the
vanilla path, which also guards against overlays.exclusive.

* add missing internal jsdoc

…id CSP (#13993) (#13997)

The grid ecommerce/license checkout (/ecommerce/) surfaced further
report-only violations on prod:

- Firebase Auth renders an auth-handshake iframe from the project authDomain
  (<projectId>.firebaseapp.com) -> frame-src. Env-split (mirrors the
  trial-form/Realex pattern): stripe-testing-19784.firebaseapp.com in
  dev/staging, aggrid-ecommerce.firebaseapp.com in production.
- Firebase Auth's GAPI client (apis.google.com/js/api.js) loads that iframe
  -> script-src.
- GA4 collect on the apex analytics.google.com, which the *.analytics.google.com
  wildcard does not match -> connect-src.

Co-authored-by: Guilherme Lopes <guilherme@gwm-solutions.com>

…14002)