Add workspace boundary constraint to AGENTS.md to prevent cross-workspace changes

What happened

On PR #3560, the code agent (which authored the PR from issue #3529) produced changes that included modifications to TabPanel.tsx in the workspaces/extensions/ directory. The PR was labeled workspace/scorecard and all other changes were within workspaces/scorecard/.

Neither the code agent nor the review agent (run 28067248042) flagged this cross-workspace contamination. Human reviewer christoph-jerolimov caught it and issued a /fs-fix command on Jul 3 to revert the unrelated changes.

The current .fullsend/AGENTS.md instructs agents to "invoke the rhdh-workspace skill" before working under workspaces/, which handles dependency installation and build routing. However, it does not explicitly state that agents should restrict their file modifications to the target workspace directory.

What could go better

The code agent should have known that a workspace/scorecard task means only files under workspaces/scorecard/ should be modified. The rhdh-workspace skill provides routing (build commands, install paths), but there is no explicit constraint telling the code agent: "do not modify files outside your target workspace."

I'm fairly confident this gap is addressable with a simple AGENTS.md instruction because: (a) the workspace structure is well-defined (each workspace has its own directory under workspaces/); (b) workspace labels are applied to PRs, providing a clear scope signal; and (c) the fix was trivial once identified (revert one file). Upstream issues (fullsend-ai/fullsend#5135, #3274, #2170) address the review agent's scope detection capabilities, but this repo-specific instruction would prevent contamination at the code agent level.

Uncertainty: it is possible the code agent touched TabPanel.tsx because a legitimate dependency chain connected the scorecard changes to extensions code. If so, the constraint would need an escape hatch for intentional cross-workspace changes. However, christoph-jerolimov's revert request suggests this was unintentional.

Proposed change

Add a workspace boundary constraint to .fullsend/AGENTS.md (or the root AGENTS.md), after the existing rhdh-workspace skill instruction:

## Workspace boundaries

This is a monorepo with independent workspaces under `workspaces/`. When
working on a task scoped to a specific workspace (indicated by the issue
label, PR label, or task description):

- Only modify files within that workspace's directory
  (e.g., `workspaces/scorecard/` for `workspace/scorecard` tasks).
- Do not modify files in other workspace directories unless the task
  explicitly requires cross-workspace changes.
- If you believe a cross-workspace change is necessary, note it in your
  PR description and explain the dependency.

This instruction targets the code agent (preventing contamination at creation time) rather than relying solely on the review agent to detect it after the fact.

Validation criteria

On the next 5 code agent PRs in this repo that are scoped to a single workspace:

1. All modified files should be within the target workspace directory.
2. No human reviewer should need to request a revert of cross-workspace file changes that were not justified in the PR description.
3. If the code agent does need to make a cross-workspace change, it should explicitly note and justify it in the PR body.

Generated by retro agent from https://github.com/redhat-developer/rhdh-plugins/pull/3560

Start by comparing .fullsend/AGENTS.md with the root AGENTS.md and read the existing rhdh-workspace instruction. Add the boundary guidance in the appropriate agent-instructions file, preserving the stated exception for intentional cross-workspace work. Confirm that the final text covers workspace scoping, permitted files, and PR justification; no code test is mentioned.