[meta] /mnt/workplace 1 GB cap — storage management for long-running sessions

## Description

`/mnt/workplace/` is AgentCore Runtime managed session storage with a **hard 1 GB cap per session** ([AWS docs § Session storage limits](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-filesystem-configurations.html)). Cumulative state from multiple invocations + the agent's own `npm test` and `npx cdk synth --quiet` verification steps can exceed the cap on a single long-running session. This bit PR #41 (issue #39) live: the agent reported `"the local working tree was unwritable (NFS export reported full)"` and fell back to the GitHub MCP gateway for the file fetch + commit. The fallback worked, but it is fragile — `git clone`, `git add`, `npm install`, and `npx cdk synth` all silently fail or partially fail on ENOSPC and there is no Setup Lambda observability into storage pressure today.

This issue tracks the broader storage-management work; it is intentionally a **tracking meta** so the individual mitigations can be filed and triaged independently.

## Where the bytes go — measured live

Captured 2026-06-05 04:08 UTC on issue #33's session via `du -sh /mnt/workplace/*` (4 Path B invocations of issue #33, no manual cleanup):

| Path | Size | % of 1 GB | Notes |
|---|---|---|---|
| `/mnt/workplace/gitproject/node_modules` | **232 MB** | 23% | `npm install` from agent's `npm test` verification. Dominated by `aws-cdk-lib` (114 MB) + `aws-cdk` (29 MB) + `typescript` (23 MB). |
| `/mnt/workplace/gitproject/cdk.out` | **101 MB** | 10% | `npx cdk synth --quiet` output. Per-Lambda bundled assets dominated by `botocore` (18 MB) + 2 instances of `cryptography` (15 MB each). |
| `/mnt/workplace/gitproject/gateway-iam-proxy/node_modules` | 23 MB | 2% | Separate `node_modules` tree for the IAM proxy workspace. |
| `.git` | 1.4 MB | <1% | trivial |
| `/mnt/workplace/.claude-data/` (PR #31 transcripts) | 2.5 MB | <1% | turn transcripts; growing per turn but small after 4 invocations |
| `/mnt/workplace/gitproject/.dev-claude/` (issue.json + invocation-N/) | 48 KB | trivial | |
| **Total** | **362 MB** | **35%** | 37,260 files (well under the ~100K-200K metadata cap) |

`node_modules` + `cdk.out` are **92% of total usage on a typical Path B verification run**. They are regenerated from scratch on every invocation that runs verification, but old copies are not cleaned up first, so each rerun risks pushing the session over the 1 GB cap.

## Acceptance Criteria

This is a tracking issue. Sub-issues will be filed for each mitigation; AC is "all sub-issues either merged or explicitly deferred."

- [ ] **Sub-issue A — observability**: Setup Lambda logs `du -sh /mnt/workplace` and `du -sh /mnt/workplace/gitproject/{node_modules,cdk.out}` at the start of `refresh_for_reinvocation`. Structured `WARNING` log if total usage > 700 MB. ~5 LOC change in `project-management/shared/assistants/base.py`. Path A.
- [ ] **Sub-issue B — cleanup at end of verification**: implement-agent and critique-agent skill files instruct the agent to `rm -rf node_modules cdk.out` after running verification (after the synth snippet has been quoted in the PR body). Reclaims ~330 MB per invocation. Path A. Touches 2 skill files in `coding-assistants/claude-code/plugin/skills/`.
- [ ] **Sub-issue C — invocation rotation cleanup**: `refresh_for_reinvocation` deletes `invocation-N/` directories older than `current_N - 1` (keep last + current). Tiny savings today (`.dev-claude/` is only 48 KB), but protects against a future where artifacts grow. Path A.
- [ ] **Sub-issue D — BYO EFS access point**: migrate from managed session storage to BYO EFS via `filesystemConfigurations: [{efsAccessPoint: ...}]`. Eliminates the 1 GB cap entirely; enables cross-session sharing. Requires `networkMode: VPC` (we already have it). Path B; architectural; only file if A+B+C don't suffice.

## Out of scope

- **`/tmp/` and `/home/bedrock_agentcore/` cleanup** — these are on the rootfs (reaped on every microVM recycle), so they don't count against the 1 GB. Not relevant here.
- **`/mnt/plugins/` cleanup** — separate S3 Files mount, not the 1 GB workspace.
- **Speculative mitigations** like compressing transcripts, swapping `npm install` for `npm ci --production`, or skipping verification entirely — none address the dominant 232 MB + 101 MB consumers.

## Cross-Resource Interactions *(tracking issue — applies to sub-issues, not to this one directly)*

- **`project-management/shared/assistants/base.py::refresh_for_reinvocation`** — sub-issues A and C both modify this function. They should land in order (A first, then C) so the structured log surface exists before the cleanup logic ships.
- **`coding-assistants/claude-code/plugin/skills/{implement,critique}/SKILL.md`** — sub-issue B modifies skill files. **Do NOT trigger sub-issue B's `agent:start` until issue #34 ships** (orchestrator stale-base + hallucinated-merge bugs); skill-file changes are exactly the surface #34's failure modes attack.
- **No CDK template change** for sub-issues A, B, C — pure Python / skill prompt edits. Sub-issue D requires CDK changes (`filesystemConfigurations` on the Runtime construct).
- **AgentCore Runtime version update resets the storage** — every `cdk deploy {project}-assistant` provisions fresh storage on the next session. So during active development this issue may "self-fix" intermittently; the fix is for stable production where redeploys are rare.

## Verification Beyond Tests

For sub-issue A:
- [ ] After deploy, trigger a representative Path B issue. Setup Lambda log group `/aws/lambda/{stack}-a-SetupLambda...` shows the new `workplace_storage` structured record with `total_mb`, `node_modules_mb`, `cdk_out_mb` fields.

For sub-issue B:
- [ ] After deploy, trigger a representative Path B issue. Probe `/mnt/workplace/gitproject/` post-PR-merge: `node_modules/` and `cdk.out/` should NOT exist (cleaned up by skill instruction). The PR body still contains the synth snippet (proof verification ran).

For sub-issue C:
- [ ] After deploy, trigger a 3rd re-invocation on an issue. `/mnt/workplace/gitproject/.dev-claude/invocation-1/` should be deleted (kept: invocation-2 + invocation-3-current).

For sub-issue D (if filed):
- [ ] After CDK deploy, the runtime spec includes `filesystemConfigurations` referencing the EFS access point ARN. `df -h /mnt/workplace` (or whatever path the EFS is mounted at) shows the EFS file system size, NOT 1 GB.

## CI Requirements

```bash
npm test # TypeScript tests
cd project-management/shared && python3 -m pytest tests/ -v # Python tests
bash test/hooks/test_hooks.sh # Hook tests
npx cdk synth --quiet # CDK validation
ruff check . # Python lint
```

All Python files must include the Apache-2.0 license header. Read `CLAUDE.md` for full conventions and security rules.

## References

- AWS docs: [File system configurations for AgentCore Runtime](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-filesystem-configurations.html), [Session storage limits](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.html#session-storage-limits)
- PR #41 (the agent's run that hit ENOSPC): https://github.com/aws-samples/sample-agent-assisted-sdlc/pull/41 — see the agent invocation summary comment on issue #39 for the verbatim "NFS export reported full" report.
- PR #31 — `CLAUDE_CONFIG_DIR=/mnt/workplace/.claude-data` (made transcripts persistent on NFS, contributing 2.5 MB on issue-33's session — small but worth knowing).
- PR #18 — `refresh_for_reinvocation` (the function sub-issues A and C extend).
- Issue #34 — orchestrator stale-base + hallucinated-merge (blocking sub-issue B's `agent:start` until merged).