S00-020: Release environment remediation for verified network access

Changes: Release S00-020 external wait through tasks.py after approved HTTPS probes. The local ignored runner configuration now uses automatic approval review with the workspace-write sandbox retained. S00-003 remains blocked until remediation implementation and independent review.
Validation: Official Node v24.21.0 SHASUMS256.txt and npm Stanza registry HEAD requests returned HTTPS 200 through the configured proxy in approved host execution. tasks.py release-external succeeded; runner --dry-run selects S00-020 with configuration_required=false. Pinned runtime execution, locked installation and integrity verification have not been performed.

scripts/kilo-agent.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+#
+# Kilo Code CLI adapter for Luma Web runner.
+#
+# The runner launches the configured argv with the task prompt piped to this
+# process's standard input (and stdout/stderr redirected to state/runs/<agent>/output.log).
+# Kilo's `run` subcommand does not consume a prompt from stdin, so we read it
+# here and pass it to `kilo run` as the message argument.
+#
+# Scope:
+#   - only reads the prompt from stdin;
+#   - forwards the runner-provided project root as the working directory;
+#   - never writes project sources on its own (Kilo does the actual work).
+set -euo pipefail
+
+# Read the full prompt from stdin (the runner pipes the prompt file here).
+prompt="$(cat)"
+
+root="$LUMA_PROJECT_ROOT"
+if [ -z "$root" ]; then
+  echo "kilo-agent: LUMA_PROJECT_ROOT is not set" >&2
+  exit 1
+fi
+
+if [ -z "$prompt" ]; then
+  echo "kilo-agent: empty prompt received on stdin" >&2
+  exit 1
+fi
+
+# Our plan file is committed to the repo; the runner also commits afterwards.
+KILO_ARGS=(run --auto --dir "$root")
+
+# Keep a session title informative for later `kilo session` inspection.
+KILO_ARGS+=(--title "luma-wave-$LUMA_ROLE")
+
+# --auto auto-approves all tool permissions so the headless runner does not
+# stall waiting for interactive approval of bash/read/edit/task tools.
+exec kilo "${KILO_ARGS[@]}" "$prompt"