docs(#2880): add sandbox image topology section to AGENTS.md

[fullsend-ai-coder]

Document which container images exist (fullsend-sandbox vs fullsend-code), which agent types use each, and their relative run frequencies. This gives the review agent discoverable context when reviewing CI infrastructure changes to action.yml or sandbox image configuration.

The mapping is derived from the harness definitions in internal/scaffold/fullsend-repo/harness/*.yaml:

• fullsend-sandbox: triage, prioritize, retro (high frequency)
• fullsend-code: code, fix, review (lower frequency)

Includes a "When reviewing CI changes" callout so agents consider blast radius when evaluating image optimization PRs.

Note: pre-commit could not run (shellcheck download blocked by sandbox network policy). Manual verification required.

---

Closes #2880

Post-script verification

• Branch is not main/master (agent/2880-sandbox-image-topology-docs)
• Secret scan passed (gitleaks — 603d68159336c07b35789beb00e45758950aaea5..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

Site preview

Preview: https://4a1a317e-site.fullsend-ai.workers.dev

Commit: 5b52b4f5af4388b63ddb839ba407be4e7e3fcac8

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 7:00 AM UTC · Completed 7:09 AM UTC
Commit: 5b52b4f · View workflow run →

[fullsend-ai-retro]

Retro: PR #2881 — docs(#2880): add sandbox image topology section to AGENTS.md

Workflow quality: Good. This was a clean end-to-end autonomous workflow: the retro agent identified a knowledge gap from PR #2796, filed issue #2880, the code agent produced accurate documentation in one shot (29 lines to AGENTS.md), and human rh-hemartin approved and merged — all within ~37 minutes.

Key observation: review agent was not dispatched

The review agent never ran on this PR. The dispatch logic calls is_event_actor_authorized("fullsend-ai-coder[bot]"), which checks GitHub's collaborator permission API. The bot user failed this check, so the dispatch silently skipped with "No stage matched." The human reviewer was the only review gate.

This is already tracked as #2674 — "dispatch: ADR 0054 authorization gate blocks review dispatch for coder-bot PRs." No new proposal needed.

Other observations (already tracked)

• Recursive retro: This retro is itself running on a PR that originated from a previous retro. Skipping retro for bot PRs with no review findings is tracked in #2638 and #2739.
• Trivial bot PR review cost: Using a cheaper model for trivial bot-authored PRs is tracked in #2842 and #2639.

No new proposals

All improvement opportunities identified are already covered by existing open issues. The workflow executed efficiently with good output quality.