Every list_* helper unwrapped a paginated envelope but never sent ?page
and never followed `next` — it read page one and stopped. Endpoints that
already paginate (tags/, pipeline/, api/deployment/) have therefore been
silently truncating at 50 rows, and the same would hit adapters,
connectors and prompt-studio once UN-3770 makes their pagination
unconditional. A clone that copies a subset without erroring is worse
than one that fails.

Add PlatformClient._paginate(), which short-circuits on a bare list so
the client keeps working against deployments where an endpoint is not
paginated, otherwise walks `next` to exhaustion. It refuses to return a
short read: the collected row count is checked against the reported
count, and a cyclic `next` raises instead of looping forever.

_request() is split so the absolute `next` URLs DRF emits can be issued
without going through org-relative path composition. Its signature is
unchanged, so every existing caller is untouched.

All 23 list helpers now route through it. list_lookup_versions keeps its
bespoke unwrap — that endpoint returns {"versions": [...]}, not a DRF
envelope.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HXYFVCZGi7YN9qjDGyJCQ

Adds a paths-scoped GitHub Actions workflow that runs the clone test
suite whenever clone code, its tests, or the dependency set changes.
Gives a fast, dedicated signal for the pagination page-following logic
in client._paginate — a silent-truncation regression there is worse
than a hard failure, so it must stay guarded on every clone change.

The full suite in test.yml still runs on every PR; this narrows the
trigger and the run to tests/clone/ for quicker feedback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

UN-3770 [CI] Add focused clone test workflow

Addresses Greptile review on #24:
- Validate the DRF envelope of every page, not just the first — a later
  page that is a bare list / non-envelope now raises PlatformAPIError
  instead of an incidental AttributeError on the next loop turn.
- Reject a `next` link whose origin differs from the configured platform
  endpoint before following it, so a compromised/misconfigured response
  cannot forward the bearer key to another host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HXYFVCZGi7YN9qjDGyJCQ

… every page

- _assert_same_origin compares normalised (scheme, host, port) so equivalent
  hosts (case, explicit default port) aren't rejected as off-site.
- _results_or_raise validates results is a list on every page, so a non-list
  results value fails loudly instead of corrupting rows via extend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HXYFVCZGi7YN9qjDGyJCQ

urlparse defers port parsing to attribute access, so a `next` link with a
non-numeric or out-of-range port leaked a ValueError from `_origin` instead
of the actionable PlatformAPIError used for every other malformed link.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HXYFVCZGi7YN9qjDGyJCQ

Addresses Greptile: mutable major-version tags (checkout@v4, setup-python@v5,
setup-uv@v6) could execute unreviewed code on an upstream tag move. Pinned to
full commit SHAs with the version tracked in a trailing comment.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HXYFVCZGi7YN9qjDGyJCQ

Two blockers from review:

- _paginate raised "unrecognised list payload" on a 204/empty body
  because None falls through to _results_or_raise. Restore the old
  (result or {}).get("results", []) behaviour: an empty body returns [].
  A next link that yields an empty body ends pagination; the count guard
  still flags a genuine short read.

- The same-origin check compared scheme+host+port, so a TLS-terminating
  proxy emitting http:// (or off-port) next links for an https:// client
  aborted every paginated list. Compare host only -- the boundary the
  bearer key is actually scoped to -- so the key still can't leak to
  another host while legitimate proxy setups keep working.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HXYFVCZGi7YN9qjDGyJCQ

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Signed-off-by: Chandrasekharan M <117059509+chandrasekharan-zipstack@users.noreply.github.com>

Two Greptile P1s on the previous review round:

- Host-only origin check let an https client follow an http:// (or
  off-port) next link on the same host, putting the bearer key on the
  wire in plaintext or at an unrelated service. Follow the link but pin
  scheme+host+port to the configured base_url, keeping only the server's
  path+query, so the key only ever reaches the configured origin. An
  off-host next is still rejected. Replaces _origin/_assert_same_host
  with _same_origin_url.

- A truthy non-string next (int/list) blew up in seen.add / urlparse
  with an incidental TypeError; guard it and raise PlatformAPIError.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HXYFVCZGi7YN9qjDGyJCQ

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HXYFVCZGi7YN9qjDGyJCQ

UN-3770 [MISC] Follow DRF pagination on all clone list endpoints