feat: add generic explore agent

[ascerra]

Summary

• Adds a generic explore agent for gathering technical context from GitHub, Jira, the target codebase, and public web sources
• Platform-aware pre/post scripts support both GitHub and Jira (ISSUE_SOURCE)
• Pipeline labels are optional via EXPLORE_READY_LABEL / EXPLORE_NEEDS_INFO_LABEL env vars (no hardcoded refinement labels)
• Includes public-research and jira-read skills for downstream customization via harness base: composition

Files added

File	Purpose
agents/explore.md	Agent prompt — research phases, confidence scoring, JSON output
harness/explore.yaml	Sandbox config, host_files, skills, env
policies/explore.yaml	Network policy (Vertex, GitHub, Jira read-only, Tavily)
schemas/explore-result.schema.json	Output validation schema
scripts/pre-explore.sh	Fetch Jira/GitHub issue context, clone referenced repos
scripts/post-explore.sh	Attach context, sticky comment, optional labels
scripts/comment-helpers.sh	Shared sticky comment + secret scanning
scripts/adf-to-markdown.py, markdown-to-adf.py	Jira ADF conversion
skills/public-research, skills/jira-read	Generic research skills

Security review

• No secrets, tokens, or org-specific references committed
• Credentials stay in runner env only (not sandbox)
• Input validation on ISSUE_SOURCE, ISSUE_KEY, REPO_FULL_NAME, and pipeline label names
• fullsend scan runs before posting comments

Code review fixes applied

• Export REFERENCED_REPOS_DIR to sandbox via env/explore.env
• Validate pipeline label env vars before GitHub/Jira mutations
• Validate REPO_FULL_NAME format in pre-script
• Set GITHUB_ISSUE_NUMBER from pre-script for GitHub runs

Follow-up (separate PRs)

• konflux-ci/refinement: thin harness with base: URL + jira-routing skill + Konflux pipeline labels
• Add test scripts for pre/post explore (similar to triage)

Test plan

• Merge this PR
• Register in refinement via thin harness + fullsend agent add
• Run explore workflow in dry-run against a GitHub issue
• Run explore against a Jira issue with credentials configured

Made with Cursor