chore: update fullsend shim workflow

[fullsend-ai-fullsend]

This PR updates the fullsend shim workflow to match the current template in the .fullsend config repo.

The shim content has drifted from the template — this brings it back in sync.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 6:12 AM UTC · Completed 6:19 AM UTC
Commit: 921ee15 · View workflow run →

[fullsend-ai-retro]

PR #46 was an automated template sync PR created by the fullsend-ai-fullsend bot to update the .github/workflows/fullsend.yaml shim in fullsend-ai/experiments. The PR brought the shim in sync with the current .fullsend template, including a security-related change to the stop-fix authorization model (moving from author_association-based checks to the collaborator permission API per ADR 0054) and a new branch filter for fullsend/scaffold-install.

A human reviewer (rh-hemartin) merged the PR via the merge queue within ~3 minutes of creation with no formal review. No agent activity occurred prior to merge — no review, code, triage, or fix agents ran. The review agent was not dispatched because the bot PR author failed the is_event_actor_authorized check in the dispatch logic, which is by design.

The retro agent was the only agent dispatched, triggered unconditionally by the PR close event (the pull_request_target/closed case in dispatch.yml is explicitly "ungated" per ADR 0054). This retro run consumed tokens to analyze a workflow with no agent involvement and no substantive findings.

Existing issue coverage: The observation that retro runs wastefully on bot-authored or zero-agent-involvement PRs is extensively documented across existing open issues. Key issues include: fullsend-ai/agents#276 (bot-PR early exit in pre-retro.sh), fullsend-ai/agents#349 (generalize to zero-agent-involvement PRs), fullsend-ai/fullsend#5399 (skip retro dispatch for merged PRs with zero agent involvement), and fullsend-ai/fullsend#5295 (skip retro for bot-authored PRs). At least 15 additional open issues cover overlapping facets of this problem. This retro provides one more data point: the fullsend/onboard branch is not filtered by the shim (only fullsend/scaffold-install is), so onboarding PRs still trigger full retro analysis despite being mechanical template syncs.

No new proposals are warranted — all identified improvement areas are already covered by existing issues.