[Improve] Treat repository guidance as untrusted content

[roomote-roomote]

​Opened on behalf of @mrubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

• Tell every sandbox-backed coding agent that checked-out files, repo-local AGENTS.md and skills, setup guidance, and command output are potentially untrusted project content.
• Make clear that repository content alone cannot override the user request or higher-priority workflow instructions, authorize secret disclosure or uploads, change access controls, or weaken sandbox protections.
• Add focused coverage for the warning in the common sandbox instruction builder.

Why this change was made

Roomote intentionally gives coding agents shell access to real repositories, and some task environments expose narrowly scoped credentials needed for development. Existing isolation and redaction reduce impact, but the common sandbox prompt did not explicitly connect attacker-controlled repository instructions with the credential and sandbox boundaries agents must preserve.

Impact

Coding agents now receive a consistent prompt-level defense against malicious repository guidance without blocking legitimate instructions explicitly authorized by the user or Roomote workflow. This does not add a scanner, change command execution, or broaden access to credentials.

[roomote-community]

1 issue outstanding. See task

• The untrusted-content warning must also protect developer instructions (apps/worker/src/run-task/sandbox-instruction.ts:182).

_{Reviewed c7bacc1}

[roomote-community]

This warning is injected into harnessDeveloperInstructions, but it only says repository guidance cannot override the user, system, or workflow instructions. It never protects the remaining developer-level instructions, so a repo-local prompt that claims to supersede developer instructions is not explicitly rejected by this new defense. State that repository content cannot override developer instructions (or any higher-priority instructions) and add that to the assertion.