Upstream encoded-slash npm policy and remove the rhdh-agentic policy copy

Context

#13 identified that OpenShell rejects Yarn requests for scoped packages because Yarn encodes the slash in URLs such as @backstage%2Fcli. That issue was completed by adding allow_encoded_slash: true to repository-local policy copies.

The merged rhdh-agentic#98 still carries the entire upstream code policy at .fullsend/rhdh/policies/code.yaml so it can add that one required field to the registry.npmjs.org endpoint. Both the code and fix harnesses override their inherited policy with this local copy.

This works, but it creates a full-policy fork that can drift from fullsend-ai/agents. The behavior belongs in the upstream package policy because scoped npm packages are a standard Yarn/npm use case, not an RHDH-specific endpoint customization.

Proposed change

1. Add allow_encoded_slash: true to the registry.npmjs.org endpoint in the upstream fullsend-ai/agents code and fix policies, including their source/template if those files are generated.
2. Validate installation of scoped npm packages through OpenShell using ghcr.io/fullsend-ai/fullsend-code:latest.
3. Update the pinned fullsend-ai/agents harness revision in rhdh-agentic.
4. Remove .fullsend/rhdh/policies/code.yaml and the policy: overrides from the RHDH code and fix harnesses.

Acceptance criteria

• yarn install --immutable can fetch scoped @backstage/* packages through OpenShell without encoded-slash denials.
• The inherited upstream policies provide the required registry.npmjs.org behavior for both code and fix agents.
• rhdh-agentic no longer carries a copied sandbox policy solely for allow_encoded_slash.
• The effective Fullsend plan for both agents resolves to the updated upstream policy.

Related

• Original encoded-slash finding and local fix: #13
• Sandbox/Yarn root-cause issue: #24
• Merged Fullsend base-image implementation: rhdh-agentic#98
• Superseded custom-image alternative: rhdh-agentic#97
• Current upstream harness pin: fullsend-ai/agents@4bbe4f50ed8e33c60539eaa30ddc320edf8bcda0

Start with .fullsend/rhdh/policies/code.yaml and the code and fix harness definitions, then inspect the pinned fullsend-ai/agents revision and its upstream code and fix policy sources or templates. Verify the upstream policy change with yarn install --immutable using ghcr.io/fullsend-ai/fullsend-code:latest, update the pin, remove the local policy and overrides, and confirm both effective plans resolve to the upstream policy.