feat(agent): route selected products to the ai-gateway

[brandonleung]

Problem

The task-sandbox agent-server sends model calls to the Python llm-gateway, whose URL carries a product slug and whose attribution rides in per-property x-posthog-property-* headers. The Go ai-gateway is slugless and reads a single X-PostHog-Properties JSON blob. To migrate one product at a time, the server needs to pick the gateway per request and speak the right wire format for whichever it picks.

Changes

• resolveGatewayTarget selects the gateway from env: AI_GATEWAY_URL picks the Go gateway, AI_GATEWAY_PRODUCTS limits it to named ai_product values. Both must be set; an unlisted product, or a listed one with no URL, stays on the Python gateway. The two gateways run on separate hosts, so the base URL is the distinguishing signal.
• On the Go path the server drops the product slug and sends one X-PostHog-Properties blob carrying ai_product, ai_stage, and team_id; the Python path is unchanged.
• buildPosthogPropertiesBlob in @posthog/shared: serializes the property set to a JSON blob, drops reserved $-prefixed keys, sanitizes keys and values to printable ASCII (Bun's fetch rejects non-ASCII header values), and drops the longest string values until the blob fits the gateway's 8192-byte cap so attribution keys survive a long task title.
• Signals sandbox stages map to per-stage ai_product tags (signals_scout, …) matching the tags the non-sandbox signals stages already emit.

Verification

buildPosthogPropertiesBlob and resolveGatewayTarget unit-tested, including byte-cap trimming (down to the boundary where every value overflows and nothing is sent), ASCII sanitization of keys and values, and the isolation cases (unlisted products and non-signals callers stay on the Python gateway). The 8192-byte cap matches the gateway's own > maxPropertiesLen check on the header value. The existing configureEnvironment suite pins the unchanged Python path. tsc and biome clean.

Rollout

Behavior is unchanged until the sandbox sets AI_GATEWAY_URL and AI_GATEWAY_PRODUCTS. This must deploy before the chart enables them. Rollback is clearing either value.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit b255d8d.}

[greptile-apps]

_{Reviews (1): Last reviewed commit: "feat(agent): route selected products to ..." | Re-trigger Greptile}