Backport .fullsend/ directory to release-v0.7, release-v0.8, release-v0.9 to restore review-agent coverage #3625

What happened

On PR #3622 targeting release-v0.7, the review agent dispatch (run 38546064382, job dispatch / Review) failed with:

✗ Environment validation failed
Error: validating env: 1 unresolved host variable(s):
    FULLSEND_APP_SET is not set (referenced by env.runner[FULLSEND_APP_SET])

Tracing the workflow graph showed this is not isolated: 23 runs on 2026-10-13 and 2026-10-14 failed with the identical error, and every one of them targeted release-v0.7, release-v0.8, or release-v0.9. Main-branch PRs succeed in the same window (e.g. run 38546047332).

The divergence is the .fullsend/ directory:

• main ships .fullsend/customized/harness/review.yaml whose base: pins fullsend-ai/agents@ce2eedd0.../harness/review.yaml. That ref has no FULLSEND_APP_SET reference, so dispatch passes host-env validation.
• release-v0.7, release-v0.8, release-v0.9 have no .fullsend/ at all (GET repos/conforma/cli/contents/.fullsend?ref=release-v0.7 → 404). The dispatch therefore resolves harness/review.yaml from a newer agents-repo ref (38faabd0...), which added FULLSEND_APP_SET: "${FULLSEND_APP_SET}" under forge.github.env.runner at line ~98 without a :- default. The host dispatch workflow in fullsend-ai/fullsend does not export FULLSEND_APP_SET, so strict validation aborts.

First observed failure of this signature: run 38446667490 on 2026-10-13 18:25 UTC. The same renovate/release-v0.7-github-actions branch had succeeded 16 hours earlier (run 38337025984 at 02:28 UTC), indicating a tooling-side change pulled in a newer base ref between the two runs.

What could go better

Release-branch PRs — including security backports like this one (openssl, glibc, curl, pcre2) — are merging without any agent review because the review dispatch cannot even start. Humans are catching nothing concerning on these small bumps today, but the safety net is absent precisely on the branches most sensitive to regressions. Two secondary gaps compound it:

1. Dispatch failures are invisible on the PR itself — the status_notifications.comment.completion: on_failure hook in .fullsend/config.yaml runs when the agent reports failure, not when the dispatch stage fails before the agent runs. The only signal is a red X on the GitHub Actions check list.
2. The agents-repo harness treats a missing host env var as a hard failure rather than defaulting to empty, which makes any repo whose .fullsend/ pin drifts fragile in the same way.

Confidence: high on root cause and scope — the error message, the ref divergence, and the branch pattern are all directly observable. Lower confidence on "best fix location": backporting .fullsend/ solves it immediately for this repo, but the underlying harness-strictness and dispatch-silence problems are platform-level and would benefit other repos too. This proposal targets the repo-level fix because it is self-contained and unblocks release-branch review coverage today; the platform fixes can be filed separately once the repo-owner confirms the backport is desired.

Proposed change

On each of release-v0.7, release-v0.8, and release-v0.9, create a .fullsend/ directory mirroring main's layout:

• .fullsend/config.yaml — copy from main, adjusting any branch-specific values if needed.
• .fullsend/customized/harness/review.yaml — copy from main. The pinned base ref (currently fullsend-ai/agents@ce2eedd0...) is known to pass env validation.
• .fullsend/customized/harness/retro.yaml and .fullsend/customized/skills/ — copy from main for parity.

Smallest viable change: just add .fullsend/customized/harness/review.yaml (with the known-good base: pin and the REVIEW_FINDING_SEVERITY_THRESHOLD: high override), since that alone will shadow the broken default resolution path. The full backport is preferred so release-branch behaviour matches main for every agent, not just review.

Consider adding a lightweight CI check (or a Renovate preset) that fails if .fullsend/customized/harness/review.yaml on a release branch drifts from main's structure, so future bumps don't silently re-break this.

Validation criteria

After the backport, open a trivial PR against each of release-v0.7, release-v0.8, release-v0.9 (e.g., a comment-only change) and confirm the dispatch / Review job in the resulting fullsend.yaml run completes success and that the review agent posts a review (approval, comment, or change request) on the PR within the usual ~15–20 min window. The next ~5 Renovate/RHSA bumps against release branches should also show a successful review dispatch rather than the FULLSEND_APP_SET is not set failure.

Generated by retro agent from #3622