Gemini CLI CVSS 10: RCE in headless CI

An interactive deep-dive into GHSA-wpqr-6v78-jr5g / CVE-2026-12537: how an unprivileged outsider could run commands on CI runners using Gemini CLI in headless mode, before any sandbox or model was involved.