chore(spec-loop): sync specs to main and advance .last-sync

[potiuk]

Summary

• Advances tools/spec-loop/.last-sync from 0e7012ba to 87be68b8 (the current main tip) and brings the three specs that had fallen behind level with what shipped.
• agent-isolation-sandbox — documents the two non-gh sandbox.excludedCommands entries (the vetted-ops read dispatcher, and the optional eval runner), the rule that anything excluded must execute code the agent cannot write, and the independent write-deny over the vetted-ops policy on both surfaces it resolves to — including the sandbox_write_denied prek entry the in-repo override needs (fix(sandbox): deny agent edits to the vetted-ops policy #1308, fix(ci): exclude the vetted-ops policy from the sandbox-write-denied hooks #1309, fix(vetted-ops): exclude the read dispatcher from the sandbox #1310), and why tools/vetted-ops/ itself is deliberately left un-denied.
• sandbox-diagnostics — seven troubleshooting entries becomes eight (the touch overlay's runtime-state directory denied, fix(agent-isolation): keep the touch overlay's state out of /tmp #1306), plus the branch-order rule the hint hook follows where two entries both end in agent refused operation.
• security-reporting — the per-issue event cache is trusted only when it was written after that issue's updatedAt, so a relabelled issue is refetched instead of being served stale label history.

No functional change: specs only.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other: tools/spec-loop/ spec sync + .last-sync bump

Test plan

• prek run --all-files passes (including spec-validate and the workspace pytest)
• For Python packages touched: uv run pytest / ruff check / mypy passes
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill
• For skill behaviour changes: a new or updated eval fixture is included in this PR
• Other: no skill, tool or eval behaviour changes — the diff is spec prose plus the .last-sync pointer

RFC-AI-0004 compliance

No principle is touched: the change adds no mutation, no host access, no
LLM hop. It records sandbox and privacy behaviour that already shipped.

Linked issues

Refs #1306, #1308, #1309, #1310.

Notes for reviewers (optional)

Worth spot-checking that the agent-isolation-sandbox wording matches
what the merged settings actually do — in particular the distinction
between the read dispatcher (excluded) and vetted-op itself (never
excluded, because --caller is argv), and the claim that the in-repo
policy override needs a sandbox_write_denied entry or prek's fixers
abort with Operation not permitted.

🤖 Generated with Claude Code