Move the trust & safety reviewer instructions from the standalone
AGENTS.md file directly into the basher agent prompt. Keeps the role
co-located with the only agent that uses it and lets the prompt evolve
without touching a separate doc.

Also tighten the output schema to report/flagged_paths so the agent
returns a single narrative report alongside the list of flagged paths
instead of a generic summary/artifacts pair.

Assisted-by: Claude Opus 4.7 via Claude Code
Signed-off-by: Xe Iaso <me@xeiaso.net>

Codifies the basher's default role as a trust & safety reviewer over
the per-run fork of TIGRIS_STORAGE_BUCKET. Spells out what to flag, the
fiction/research carve-outs, the quarantine layout (move, never
delete), CSAM/secrets special cases, and the REPORT.md output shape so
findings survive the teardown.

Flue reads AGENTS.md from the sandbox cwd at runtime, so this file
also needs to be present in the canonical bucket the fork is taken
from — uploading it there is a separate deploy step.

Assisted-by: Claude Opus 4.7 via Claude Code
Signed-off-by: Xe Iaso <me@xeiaso.net>

Switch the per-run workspace from createWorkspace to createForks against
process.env.TIGRIS_STORAGE_BUCKET so the agent starts on a writable
scratch copy of the source data instead of an empty bucket. Forking is
the only agent-kit primitive that accepts a source bucket today (see
~/tmp/agent-kit-workspace-forking.md for the createWorkspace `from:`
proposal that would unify both shapes).

Tradeoff: createForks doesn't yet take ttl or enableSnapshots, so the
fork is not auto-expiring and snapshot retention follows the base
bucket's policy. teardownForks in finally still keeps the blast radius
of a single run bounded.

The prompt now tells the model which base bucket and snapshot the fork
came from so it can reason about the dataset it inherited.

Assisted-by: Claude Opus 4.7 via Claude Code
Signed-off-by: Xe Iaso <me@xeiaso.net>

Tigris bucket names are S3-style — lowercase letters, digits, dots, and
hyphens only. Flue's runId isn't guaranteed to satisfy that, so any
uppercase or unsafe character in the id would make createWorkspace fail
on submission. Lowercase and substitute non-conforming bytes with `-`
before handing the name to agent-kit.

Also refresh the agent-shell connector docstring example to use the
recommended agent-kit workspace flow, matching the updated installer
instructions.

Assisted-by: Claude Opus 4.7 via Claude Code
Signed-off-by: Xe Iaso <me@xeiaso.net>

Replace the static TIGRIS_STORAGE_BUCKET wiring with createWorkspace /
teardownWorkspace from @tigrisdata/agent-kit. Each invocation now gets a
scoped, time-bounded bucket (1d TTL, snapshots enabled, Editor-scoped
key) keyed by the Flue runId, and the workspace is torn down in finally
so a thrown prompt or a forgotten flush can't leak agent data into a
long-lived bucket.

Assisted-by: Claude Opus 4.7 via Claude Code
Signed-off-by: Xe Iaso <me@xeiaso.net>

Wrap TigrisShell into a Flue SandboxFactory via a small SandboxApi
adapter so agents can mount a Tigris-backed bash without reaching into
just-bash directly. The connector deliberately does not flush — callers
own the shell lifecycle and decide when writes become durable.

Migrate the basher agent over to the new connector and drop the direct
just-bash dependency. The agent prompt now advertises the tigris-aware
shell builtins (presign, snapshot, fork, forks) the shell exposes.

Assisted-by: Claude Opus 4.7 via Claude Code
Signed-off-by: Xe Iaso <me@xeiaso.net>