fix(#170): remove inert disallowedTools from agent definitions

[fullsend-ai-coder]

Remove disallowedTools frontmatter from agents/code.md, agents/fix.md, agents/review.md, and agents/retro.md. These entries are inert in --agent sessions (per ADR [balkov] EDIT: 0027 0024) and Bash(...) entries trigger a Claude Code bug that removes the entire Bash tool, causing costly subagent fallbacks.

Also remove the inert tools key from agents/review.md and agents/retro.md.

Update comments in harness, env, policy, and skill files to reference the actual enforcement mechanisms: sandbox token scoping (read-only GH_TOKEN), PUSH_TOKEN isolation, and network policy binary allowlists.

---

Closes #170

Post-script verification

• Branch is not main/master (agent/170-remove-disallowed-tools)
• Secret scan passed (gitleaks — 0dbf1959357382ecdb9bb39e3c69a5fa678af3c1..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[ben-alkov]

LGTM

[maruiz93]

Reviewed the diff against the RCA findings (discussion fullsend-ai/fullsend#5182) and Ben's experimentation on fullsend#4437 confirming that tools: scoping (e.g. Bash(gh)) grants full Bash access — so retro.md's Bash(gh,jq) restriction was cosmetic.

Agent frontmatter removal is correct across all four files. Comment updates in harness, env, policies, and skill accurately describe the real enforcement mechanisms (token scoping, PUSH_TOKEN isolation, binary allowlists). SKILL.md rationale change for --amend is sound.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 3:41 PM UTC · Completed 3:49 PM UTC
Commit: f930a5f · View workflow run →

[fullsend-ai-retro]

PR #171 (fix: remove inert disallowedTools from agent definitions) was a clean, single-iteration code agent run that completed in 7m36s with no rework needed. The code agent correctly identified and modified all 14 affected files across agent definitions, harness configs, policies, env files, and the code-implementation skill. Three human reviewers approved with no inline change requests, and the PR was merged ~2 days later. Three workflow issues were identified: (1) the review agent never dispatched because the post-code script failed to apply the ready-for-review label (already tracked in #199), (2) the triage agent inappropriately applied a blocked label during re-triage while the implementing PR was already open, and (3) the code agent propagated an incorrect ADR reference from the issue body into its PR description, requiring human correction.

Proposals filed

• Triage agent should not apply 'blocked' label when an implementing PR already exists (in fullsend-ai/agents)
• Review agent was not dispatched on PR #171 due to ready-for-review label failure (in fullsend-ai/agents)
• Code agent should not propagate unverified document references from issue body into commit messages (in fullsend-ai/agents)