feat(#609): ship default AGENTS.md in scaffold

[rh-hemartin]

Summary

• Add a default AGENTS.md to the scaffold with baseline behavioral guidelines (think before acting, simplicity first, surgical changes, goal-driven execution)
• Update fullsend run to inject the org-level AGENTS.md into the target repo workspace when the repo doesn't have its own, hidden from git status via .git/info/exclude
• Add hasAgentsMD() helper with tests covering all common casings

Test plan

• make lint passes
• make go-test passes
• Unit tests for hasAgentsMD() cover uppercase, lowercase, title case, missing, and unrelated files
• Verify scaffold deploys AGENTS.md to .fullsend repo during install
• Verify agent reads injected AGENTS.md when target repo has none
• Verify repo-level AGENTS.md takes precedence over org-level default

Closes #609

🤖 Generated with Claude Code

[fullsend-ai-review]

Review: #680

Head SHA: 9d3a31b
Timestamp: 2026-05-06T00:00:00Z
Outcome: comment-only

Summary

This PR adds a default AGENTS.md to the scaffold and injects it into target repos at runtime when they lack their own. The implementation is correct and well-structured — the hasAgentsMD helper is clean, the SCP + .git/info/exclude mechanism is appropriate, error handling is consistent with surrounding code, and the test coverage for the helper is solid. Three medium/low findings are noted below, none of which block merge.

Findings

Medium

• [content-security] internal/scaffold/fullsend-repo/AGENTS.md:3-4 — The instruction "Check if there are CLAUDE.md or AI.md in the root of this repository and if there are stop reading this file" creates a bypass vector. An attacker submitting a PR could include a CLAUDE.md (or AI.md) in their branch that causes agents to skip the org-level behavioral guardrails in this file. While the security scanner catches explicit injection patterns in context files, a subtly adversarial CLAUDE.md that stays below injection detection thresholds could still degrade agent behavior (e.g., encouraging sweeping changes instead of surgical ones). Consider removing this self-disabling instruction and instead letting the runtime injection logic in run.go handle precedence — it already only injects when no AGENTS.md exists. If CLAUDE.md coexistence is desired, the agent framework should handle file priority, not the file contents themselves.

Low

• [correctness] internal/cli/run.go:1015-1021 — hasAgentsMD checks three casings (AGENTS.md, agents.md, Agents.md) but misses others like AGENTS.MD or AgEnTs.md. On case-sensitive Linux filesystems (the likely sandbox OS), uncommon casings would cause the org-level file to be injected alongside an existing one. Risk is low since the three covered casings represent nearly all real-world usage. A case-insensitive directory scan (e.g., strings.EqualFold over directory entries) would be more robust if desired.

• [correctness] internal/cli/run_test.go — The PR checklist shows three unchecked manual verification items (scaffold deploy, agent reads injected file, repo-level precedence). These represent the integration-level behaviors that unit tests for hasAgentsMD don't cover. Not a blocker, but worth tracking as follow-up validation before the feature is relied upon in production.

Footer

Outcome: comment-only
This review applies to SHA 9d3a31bac05652ef01ba19864f56a6c6e0acbec4. Any push to the PR head clears this review and requires a new evaluation.

[fullsend-ai-review]

See the review comment for full details.

[ralphbean]

\o/