fix(fullsend): bump to v0.39.0, pin Opus 4.6, allowlist claude.exe

[johnmcollier]

Summary

• Bump reusable-dispatch.yml to v0.39.0 (ISSUE_URL / tracker env for triage).
• Pin customized code/fix agents to claude-opus-4-6; Opus 4.8 is not enabled on this Vertex project.
• Allowlist **/claude.exe in the RHDH code policy so Claude Code 2.1+ can reach Vertex STS.

Test plan

• Merge, then comment /fs-triage on a small issue and confirm the pre-script gets past ISSUE_URL
• For customized agents, confirm the run uses claude-opus-4-6 and does not policy_denied on Vertex

Made with Cursor

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure · Started 2:49 PM UTC · Completed 2:51 PM UTC

Commit: e6739e8 · View workflow run →

[fullsend-ai-review]

Review skipped — this PR is already merged.

The /fs-review command only reviews open PRs/MRs.

_{Posted by fullsend pre-review check}

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 2:51 PM UTC · Completed 2:58 PM UTC

Commit: e6739e8 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.23

[fullsend-ai-retro]

Retro: PR #12 — bump to v0.39.0, pin Opus 4.6, allowlist claude.exe

This was a human-authored configuration PR (#12) that was merged ~45 seconds after creation. No code, fix, or triage agents were involved. The review agent was dispatched on pull_request_target (opened) but never ran — the pre-script detected the PR was already merged, posted a skip comment, and exited cleanly. However, the harness continued to create a sandbox (50s), which then failed a pre-flight GitHub API connectivity check (HTTP 403 proxy block). The review workflow run concluded as failure.

Evidence for existing open issues

• Review on merged PR / pre-script abort (fullsend-ai/fullsend #3690, #2809, #4070, #6040): The pre-script logged "PR fix(fullsend): bump to v0.39.0, pin Opus 4.6, allowlist claude.exe #12 is MERGED -- skipping review" but exited 0, causing the harness to proceed with sandbox creation. This is another instance of the pattern where the pre-script cannot signal an abort to the harness.
• Retro on zero-agent-involvement PR (fullsend-ai/fullsend #5399, #6297): This retro was dispatched on a merged PR where the review agent never executed and no other agent was involved. The retro had minimal signal to analyze.
• Sandbox proxy / connectivity (fullsend-ai/fullsend #4565, #4629): The review agent sandbox failed the pre-flight GitHub API connectivity check with HTTP 403, same class of proxy-allowlist issue reported across multiple retro sandbox issues.

Novel finding

The PR adds **/claude.exe to the repo-local code policy because Claude Code 2.1+ ships as a bun-compiled claude.exe binary that doesn't match the existing **/claude glob. This is a repo-local fix for what appears to be a gap in the upstream default policy in fullsend-ai/agents. One proposal filed below.

Proposals skipped (target repo not allowed)

File manually or update create_issues.allow_targets in config.yaml:

• **Add /claude.exe to default base policy binary allowlist (fullsend-ai/agents)