fix(agent): pass large Antigravity prompts on stdin and allow pwd

[shunkakinoki]

Deliver Antigravity prompts that exceed the platform argv cap on stdin with no --prompt/--print/-p flag (agy >= 1.1.1 still reads non-TTY stdin when no prompt flag is present). Small prompts keep --prompt. Drop --sandbox for non-agentic print-mode reviews so pwd is not permission-gated. Reviews still do not get --dangerously-skip-permissions.

[roborev-ci]

roborev: Combined Review (ea2e489)

Code changes require revision: one medium-severity sandboxing issue could allow background reviews to modify tracked files.

Medium

• Background Antigravity reviews can mutate the real checkout — internal/agent/gemini.go:179
  Removing --sandbox runs non-agentic Antigravity reviews in the real checkout. Merely omitting --dangerously-skip-permissions does not guarantee read-only behavior because global Antigravity permissions may already authorize mutating tools or commands. Preserve sandboxing while narrowly allowing read-only probes such as pwd, or execute reviews in a disposable/read-only checkout.

---

Reviewers: 2 done | Synthesis: codex, 14s | Total: 3m16s

[roborev-ci]

roborev: Combined Review (aaea640)

The PR needs changes: two medium-severity issues could crash the daemon and leave Antigravity’s security documentation inaccurate.

Medium

• internal/agent/antigravity_settings.go:83 — A valid settings file containing JSON null unmarshals to a nil map. Assigning doc["permissions"] then panics and can crash the daemon. Reinitialize or reject a nil root map after unmarshalling, and add coverage for null.

• internal/agent/gemini.go:182, docs/agents/index.md:183 — Reviews now omit --sandbox and automatically persist broad global permissions, but the documentation still promises sandbox confinement and suggests users can narrow a wildcard rule that subsequent reviews will restore. Document the automatic global merge, unsandboxed behavior, permission scope, and any opt-out.

---

Reviewers: 2 done | Synthesis: codex, 7s | Total: 5m34s