Define developer and summary-agent tool profiles

[itsjling]

Closes #33

Summary

• define separate developer and product-summary tool profiles
• keep summary runs free of broad user config, secrets, network, and tools by default
• cover allowed, denied, prompted, failed, and timed-out fake MCP calls

Stack

• base: Disable unsafe Cursor reviews #51 for Enforce no-tool execution for Cursor reviews #31
• cross dependency: Add a clean-checkout product gate #41 for Create one clean-checkout development gate #16
• cross dependency: Require trust before repo automation runs #50 for Require trust before running repo-owned agent automation #32

Do not merge this PR until both cross dependencies land.

Verification

• npm run lint
• npm test
• npm run docs:check
• npm run docs:build
• npx fallow audit --base codex/issue-031-cursor-sandbox

Stack

1. Disable unsafe Cursor reviews #51
2. Define developer and summary-agent tool profiles #54 👈 current
3. Preserve good notes when agents or files fail #56

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d85e3c299a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[itsjling]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a0f36a9f2b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".