agy-implementlisted

# Delegate implementation to agy, then verify Complements `agy-adversarial-review` (review-only intent via `--mode plan`). This skill goes the other direction: agy **writes code**, so the safety comes from three stacked boundaries — worktree isolation, the sandbox with a targeted allow-list, and mandatory review before anything reaches the main branch. ## Before the first run of a session Read **[`../agy-adversarial-review/references/agy-runtime.md`](../agy-adversarial-review/references/agy-runtime.md)**. It holds the family-level mechanics shared by both agy roles — the permission allow-list, the `--add-dir` workspace trap, the silent-death mode, auth diagnosis, and the model catalogue. This file assumes you know them and covers only what makes a run an *implementation*. Two runtime facts this role depends on directly: - The **write set** is the read-only git rules plus `unsandboxed(git add)`, `unsandboxed(git commit)`, and the pinned test-runner spellings (a ruled exception — the runtime file carries the ruling and what it costs). `push`, `reset`, `checkout`, `clean` and `worktree` are deliberately absent, which keeps no-push machine-enforced everywhere except inside the test-runner process. Never reach for `--dangerously-skip-permissions` to unblock something. - **A run that returns nothing did not necessarily do nothing** — an auto-denied permission kills the run with zero output while edits made before the denial are already on disk. The forensic com