fix(scaffold): allow claude.exe and pi on the Vertex profile

Claude Code 2.1.2xx ships as a Bun-compiled binary named claude.exe
even on Linux, and since #6647 the CLAUDE_CODE_VERSION-pinned install
is the binary that runs in the sandbox. The scaffold Vertex profile
only allowlisted **/claude, so OpenShell's OPA denied claude.exe the
STS call and every Claude run on the 0.40.0 image failed on its first
request with "API Error: Error code policy_denied" (0 tokens). The
fleet copy in fullsend-ai/agents was fixed by fullsend-ai/agents#1118;
this repo's embedded copy, which functional-tests and local runs load
through --fullsend-dir, was not.

Add **/claude.exe and **/pi so the binaries list matches the agents
copy (**/pi is carried for parity with that copy; pi itself runs via
node), pin the whole list in a scaffold test so the two copies cannot
drift on this again, and update the bring-your-own-agent guide and the
runtime egress diagram that still showed the old list.

Refs #6971

Assisted-by: Claude (code, fix, review), Grok (review)
Signed-off-by: Wayne Sun <gsun@redhat.com>

Author: waynesun09

docs/contributing/runtime-implementation.md

@@ -55,7 +55,7 @@ flowchart TB
   end
   subgraph SB["Sandbox boundary — OpenShell + L7 egress policy (containment)"]
     direction TB
-    EG["egress allowlist: *.googleapis.com · api.anthropic.com\n(+ api.openai.com POST /v1/responses with the openai provider)\nbinaries: **/claude · **/node (pi runs via node) · **/codex"]
+    EG["egress allowlist: *.googleapis.com · api.anthropic.com\n(+ api.openai.com POST /v1/responses with the openai provider)\nbinaries: **/claude · **/claude.exe · **/node (pi runs via node) · **/pi · **/codex"]
     subgraph PROC["Runtime process — steering, defense in depth"]
       direction LR
       PRE["PreToolUse\nTirith · SSRF\ncanary · allowlist"]

docs/guides/user/bring-your-own-agent.md

@@ -132,9 +132,13 @@ endpoints:
     enforcement: enforce
 binaries:
   - "**/claude"
+  - "**/claude.exe"
   - "**/node"
+  - "**/pi"
 ```
 
+> Claude Code 2.1.2xx installs its native binary at `bin/claude.exe` even on Linux, so the allowlist needs both `**/claude` and `**/claude.exe`; with only the former the run fails on its first call with `API Error: Error code policy_denied`.
+
 > **Note (CI only):** the provider profile above controls network access only; real credentials are delivered via `host_files` (see [real-world example](#real-world-example-the-triage-agent)). Make sure you've completed the GCP prerequisites in [Before you begin](#before-you-begin).
 
 **`agents/my-agent.md`:**

internal/scaffold/fullsend-repo/profiles/fullsend-vertex-ai.yaml

@@ -20,4 +20,6 @@ endpoints:
     allow_uninspected_credentials: true
 binaries:
   - "**/claude"
+  - "**/claude.exe"
   - "**/node"
+  - "**/pi"

internal/scaffold/scaffold_test.go

@@ -1022,3 +1022,21 @@ func TestPrependManagedHeaderNoHeader(t *testing.T) {
 	result := PrependManagedHeader("AGENTS.md", content)
 	assert.Equal(t, content, result, "files without headers should be returned unchanged")
 }
+
+func TestScaffoldVertexProfile_BinaryAllowlist(t *testing.T) {
+	data, err := FullsendRepoFile("profiles/fullsend-vertex-ai.yaml")
+	require.NoError(t, err)
+
+	var profile struct {
+		Binaries []string `yaml:"binaries"`
+	}
+	require.NoError(t, yaml.Unmarshal(data, &profile))
+
+	// Pin the whole list, not just the two entries #6971 added: this copy
+	// must stay in sync with profiles/fullsend-vertex-ai.yaml in
+	// fullsend-ai/agents (the fleet copy), which is what the sandbox
+	// actually enforces. Claude Code 2.1.2xx installs its native binary at
+	// bin/claude.exe even on Linux, so **/claude alone denies it STS access.
+	assert.ElementsMatch(t, []string{"**/claude", "**/claude.exe", "**/node", "**/pi"}, profile.Binaries,
+		"scaffold Vertex profile binaries drifted from the fullsend-ai/agents copy")
+}