Raise sandbox.agent.sudo: false coverage to 80% of workflows

.github/workflows/daily-multi-device-docs-tester.md

@@ -15,6 +15,11 @@ permissions:
   contents: read
   issues: read
   pull-requests: read
+
+sandbox:
+  agent:
+    sudo: false
+
 tracker-id: daily-multi-device-docs-tester
 max-turns: 80  # 10 devices × ~5 turns each + setup/report overhead
 engine:

.github/workflows/daily-performance-summary.md

@@ -11,6 +11,11 @@ permissions:
   issues: read
   pull-requests: read
   discussions: read
+
+sandbox:
+  agent:
+    sudo: false
+
 engine:
   id: copilot
   copilot-sdk: true

.github/workflows/daily-regulatory.md

@@ -11,6 +11,11 @@ permissions:
   issues: read
   pull-requests: read
   discussions: read
+
+sandbox:
+  agent:
+    sudo: false
+
 strict: true
 tracker-id: daily-regulatory
 max-ai-credits: 1000

.github/workflows/daily-reliability-review.md

@@ -10,6 +10,11 @@ permissions:
   contents: read
   issues: read
   pull-requests: read
+
+sandbox:
+  agent:
+    sudo: false
+
 tracker-id: daily-reliability-review
 engine: claude
 strict: true

.github/workflows/daily-safe-output-integrator.md

@@ -8,6 +8,11 @@ permissions:
   issues: read
   pull-requests: read
   copilot-requests: write
+
+sandbox:
+  agent:
+    sudo: false
+
 imports:
 - uses: shared/daily-audit-base.md
   with:

.github/workflows/daily-safe-output-optimizer.md

@@ -13,6 +13,10 @@ permissions:
   pull-requests: read
   actions: read
 
+sandbox:
+  agent:
+    sudo: false
+
 engine: claude
 safe-outputs:
   create-issue:

.github/workflows/daily-safeoutputs-git-simulator.md

@@ -9,6 +9,11 @@ permissions:
   contents: read
   issues: read
   pull-requests: read
+
+sandbox:
+  agent:
+    sudo: false
+
 engine: claude
 strict: true
 tools:

.github/workflows/daily-secrets-analysis.md

@@ -10,6 +10,11 @@ permissions:
   pull-requests: read
   discussions: read
   copilot-requests: write
+
+sandbox:
+  agent:
+    sudo: false
+
 engine:
   id: copilot
   copilot-sdk: true

.github/workflows/daily-security-red-team.md

@@ -10,6 +10,11 @@ permissions:
   issues: read
   security-events: read
   copilot-requests: write
+
+sandbox:
+  agent:
+    sudo: false
+
 tracker-id: security-red-team
 engine: claude
 strict: true

.github/workflows/daily-semgrep-scan.md

@@ -17,6 +17,11 @@ permissions:
   pull-requests: read
   security-events: read
   copilot-requests: write
+
+sandbox:
+  agent:
+    sudo: false
+
 safe-outputs:
   create-code-scanning-alert:
     driver: "Semgrep Security Scanner"

.github/workflows/daily-sentrux-report.md

@@ -9,6 +9,11 @@ on:
 timeout-minutes: 30
 permissions:
   contents: read
+
+sandbox:
+  agent:
+    sudo: false
+
 imports:
   - uses: shared/daily-audit-base.md
     with:

.github/workflows/daily-spdd-spec-planner.md

@@ -13,6 +13,11 @@ permissions:
   pull-requests: read
 
   copilot-requests: write
+
+sandbox:
+  agent:
+    sudo: false
+
 tracker-id: daily-spdd-spec-planner
 engine:
   id: copilot

.github/workflows/daily-syntax-error-quality.md

@@ -11,6 +11,11 @@ permissions:
   issues: read
   pull-requests: read
   copilot-requests: write
+
+sandbox:
+  agent:
+    sudo: false
+
 tracker-id: daily-syntax-error-quality
 engine:
   id: copilot

.github/workflows/daily-team-evolution-insights.md

@@ -11,6 +11,11 @@ permissions:
   issues: read
   pull-requests: read
   discussions: read
+
+sandbox:
+  agent:
+    sudo: false
+
 tracker-id: daily-team-evolution-insights
 engine: claude
 strict: false

.github/workflows/daily-token-consumption-report.md

@@ -8,6 +8,11 @@ permissions:
   contents: read
   issues: read
   pull-requests: read
+
+sandbox:
+  agent:
+    sudo: false
+
 tracker-id: daily-token-consumption-report
 engine: claude
 strict: true

.github/workflows/daily-windows-terminal-integration-builder.md

@@ -13,6 +13,10 @@ permissions:
   actions: read
   issues: read
 
+sandbox:
+  agent:
+    sudo: false
+
 tools:
   github:
     mode: gh-proxy

.github/workflows/daily-workflow-updater.md

@@ -14,6 +14,11 @@ permissions:
   issues: read
 
   copilot-requests: write
+
+sandbox:
+  agent:
+    sudo: false
+
 tracker-id: daily-workflow-updater
 engine:
   id: copilot

.github/workflows/dataflow-pr-discussion-dataset.md

@@ -11,6 +11,11 @@ permissions:
   discussions: read
   pull-requests: read
   issues: read
+
+sandbox:
+  agent:
+    sudo: false
+
 network:
   allowed:
     - defaults

.github/workflows/deep-report.md

@@ -16,6 +16,10 @@ permissions:
   discussions: read
   security-events: read
 
+sandbox:
+  agent:
+    sudo: false
+
 tracker-id: deep-report-intel-agent
 timeout-minutes: 45
 engine: claude

.github/workflows/delight.md

@@ -9,6 +9,11 @@ permissions:
   issues: read
   pull-requests: read
   copilot-requests: write
+
+sandbox:
+  agent:
+    sudo: false
+
 network:
   allowed:
   - defaults

.github/workflows/dependabot-burner.md

@@ -21,6 +21,11 @@ permissions:
   contents: read
   issues: read
   pull-requests: read
+
+sandbox:
+  agent:
+    sudo: false
+
 concurrency:
   group: dependabot-burner
   cancel-in-progress: false

.github/workflows/dependabot-go-checker.md

@@ -18,6 +18,10 @@ permissions:
   security-events: read
   vulnerability-alerts: read
 
+sandbox:
+  agent:
+    sudo: false
+
 network:
   allowed:
     - defaults

.github/workflows/designer-drift-audit.md

@@ -8,6 +8,11 @@ permissions:
   contents: read
   issues: read
   pull-requests: read # required by pull_requests
+
+sandbox:
+  agent:
+    sudo: false
+
 tools:
   github:
     mode: gh-proxy

.github/workflows/dev-hawk.md

@@ -17,6 +17,11 @@ permissions:
   actions: read
   pull-requests: read
   copilot-requests: write
+
+sandbox:
+  agent:
+    sudo: false
+
 engine:
   id: copilot
   copilot-sdk: true

.github/workflows/developer-docs-consolidator.md

@@ -9,6 +9,11 @@ permissions:
   contents: read
   issues: read
   pull-requests: read
+
+sandbox:
+  agent:
+    sudo: false
+
 network:
   allowed:
   - defaults

.github/workflows/dictation-prompt.md

@@ -14,6 +14,11 @@ permissions:
   pull-requests: read
 
   copilot-requests: write
+
+sandbox:
+  agent:
+    sudo: false
+
 engine:
   id: copilot
   copilot-sdk: true

.github/workflows/docs-noob-tester.md

@@ -10,6 +10,11 @@ permissions:
   issues: read
   pull-requests: read
   copilot-requests: write
+
+sandbox:
+  agent:
+    sudo: false
+
 engine:
   id: copilot
   copilot-sdk: true

.github/workflows/draft-pr-cleanup.md

@@ -11,6 +11,11 @@ permissions:
   pull-requests: read
   # Note: PR write operations handled via safe-outputs
   copilot-requests: write
+
+sandbox:
+  agent:
+    sudo: false
+
 engine:
   id: copilot
   copilot-sdk: true

.github/workflows/duplicate-code-detector.md

@@ -10,6 +10,11 @@ permissions:
   contents: read
   issues: read
   pull-requests: read
+
+sandbox:
+  agent:
+    sudo: false
+
 engine: codex
 network:
   allowed:

.github/workflows/eslint-miner.md

@@ -11,6 +11,11 @@ permissions:
   pull-requests: read
   actions: read
   copilot-requests: write
+
+sandbox:
+  agent:
+    sudo: false
+
 tracker-id: eslint-miner
 engine:
   id: copilot