Build the foundation, before the agent gets write access

The prompt

Stand up the repository structure, a sandbox environment, a scoped workload identity, logging, and a real CLAUDE.md — with no agent write access yet. Confirm the repository and cloud boundary are fully operational without it.

Why it's built that way

Exit criterion from the challenge's Foundation phase: the repository and cloud boundary are operational without agent write access. Everything else in the capstone depends on this existing first.

What to do with the answer

Don't grant any agent access until this phase's exit criterion is genuinely met — it's tempting to skip ahead, and it's the one shortcut that undoes everything downstream.