chore: update fullsend shim workflow

[fullsend-ai-fullsend]

This PR updates the fullsend shim workflow to match the current template in the .fullsend config repo.

The shim content has drifted from the template — this brings it back in sync.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 12:21 PM UTC · Completed 12:30 PM UTC
Commit: 521ed8b · View workflow run →

[fullsend-ai-retro]

Retro: PR #41 — chore: update fullsend shim workflow

What happened: PR #41 was a trivial, fully automated PR created by fullsend-ai-fullsend[bot] to sync the .github/workflows/fullsend.yaml shim with the canonical template. The sole change added labeled and unlabeled to the pull_request_target event types (1 line changed). The PR was merged by waynesun09 approximately 21 hours after creation with zero reviews — neither human nor automated.

Key observations:

1. Review agent never dispatched. The dispatch workflow's has_write_permission() function queries the GitHub collaborator permission API, which returns an empty role for GitHub App bot accounts (they authenticate via installation tokens, not collaborator roles). This caused all three pre-merge dispatch attempts to output "No stage matched — skipping dispatch." This is a known gap tracked in fullsend#5188.

2. Retro agent dispatched on a zero-agent-involvement bot PR. The retro stage triggered unconditionally on the closed event, spending compute analyzing a PR with no agent interaction to evaluate. This pattern is tracked in fullsend#5185 and fullsend#3226.

3. No review of any kind before merge. The combination of the dispatch gap (#5188) and the absence of branch protection requiring reviews meant this workflow file change landed with no automated or human quality gate. The experiments repo already tracks a related improvement in experiments#37 (enforce required human review for protected paths).

No new proposals filed. All improvement opportunities identified in this retro are already covered by existing open issues. The most impactful fixes would be resolving fullsend#5188 (enable review dispatch for org-owned bot PRs) and fullsend#5185 (skip or minimize retro for zero-agent-involvement bot PRs).