fix: copy fullsend binary to sandbox for pre-agent security scan

[ralphbean]

Summary

Fixes the pre-agent security scan failure where fullsend scan context couldn't be found inside the sandbox.

Problem

The triage workflow failed with:

find: 'fullsend': No such file or directory
Error: pre-agent security scan blocked: critical findings detected

The pre-agent security scan runs inside the sandbox and executes:

find /tmp/workspace/target-repo -maxdepth 3 -type f \( ... \) -exec fullsend scan context {} +

However, the fullsend binary was only installed on the GitHub Actions runner host, not in the sandbox image.

Solution

1. Copy fullsend binary into sandbox (bootstrapSandbox)

• Uses os.Executable() to find the current fullsend binary
• Copies it to /tmp/workspace/bin/fullsend in the sandbox
• Makes it executable with chmod +x

2. Source .env before scanning (buildScanContextCommand)

• Added source /tmp/workspace/.env && before the find command
• Ensures PATH includes /tmp/workspace/bin where fullsend is installed

This approach:

• ✅ Works for both development (vendored binary) and production (released binary)
• ✅ Ensures version match between host CLI and sandbox CLI
• ✅ Follows the same pattern as buildClaudeCommand which also sources .env

Test Plan

Manual verification:

• Run fullsend run triage locally with openshell available
• Verify pre-agent scan step completes without "No such file or directory" error

E2E verification:

• Trigger triage workflow on a test issue
• Verify workflow completes successfully

Related

Fixes: https://github.com/fullsend-ai/.fullsend/actions/runs/24842943162/job/72721816328

[github-actions]

Site preview

Preview: https://db670abd-site.fullsend-ai.workers.dev

Commit: b3d267a5c8f88f1b68d12d914cf08ba0e58da9bb

[ralphbean]

Original Failure

This fix addresses the failure observed in:
https://github.com/fullsend-ai/.fullsend/actions/runs/24842943162/job/72721816328#step:10:215

The error at step 10, line 509 was:

find: 'fullsend': No such file or directory
Error: pre-agent security scan blocked: critical findings detected

[waynesun09]

Reviewed across 4 agents (Claude, Gemini, Cursor, security-focused). All approve. One suggestion: add a unit test for buildScanContextCommand (see inline comment).