Flow B: coder PR change-description + faster security review

[elamaran11]

Flow B improvements: PR change-description + faster security review

Two Dark Factory (Flow B) improvements, both requested during the live dry-run.

1. Coder emits a PR change-description (reviewer request)

The coder now writes a concise, reviewer-facing description of what it changed (and why) to artifacts/description.md as part of its run, and the PR body renders it as a ### 📝 Changes section above the existing verification block.

• claude path: instruction appended to the prompt.
• kiro path: same instruction appended to SPEC.md.
• PR body: the Changes section sits before the <!-- dark-factory:status --> marker, so status.js (which rewrites from the marker down) preserves it on every status update.
• Falls back to a neutral line if the coder produced no description (body never empty).

2. Security review no longer blocks ~15 min after the result is known

Observed in the dry-run: the AWS Security Agent App bot posts "No issues identified" on the PR, but our headless security-agent.sh step kept polling IN_PROGRESS for the full timeout because the job's status field flips to COMPLETED long after findings are ready.

• Early-exit: each poll iteration now also probes list-findings; the moment it returns a well-formed result, we proceed — no waiting for the status flip. (Reuses those findings; no re-fetch.)
• Graceful timeout: this step is advisory (the App bot posts the authoritative result regardless), so exceeding the timeout now posts a neutral pending status + a pointer to the bot comment, instead of a misleading red error.
• Side effect: the sticky status board (which depends on the security step) is now rewritten with accurate rows within seconds instead of ~15 min later.

Note on rollout

Change #1 is in the coder image (entrypoint.js) → takes effect once the coder image is rebuilt/pushed. Change #2 is a hub-side ConfigMap script → live on ArgoCD sync of dark-factory-hub.

Verification

• node --check on entrypoint.js + status.js; sh -n on security-agent.sh.
• Changes section verified to render above the status marker (preserved by status.js).

Generated with Claude Code.

[elamaran11]

Consolidated into #41 (flow-d-lambda-microvm-sandbox) per request — the coder PR-description + security-agent early-exit commits are cherry-picked there.