sandcastle: QA PR-head config fix on real labeled PRs

[arndvs]

Migrated from arndvs/dotfiles-private#263 (sandcastle engine issues live on ctrlshft).

Type: HITL
Parent PRD: #257
Blocked by: #258, #259, #260, #261, #262

Description

Manual end-to-end QA for the PR-head config fix (#258–#262) against real labeled PRs.

1. Open a same-repo PR that changes sandcastle.config.json (e.g. flips proxy to false) and apply one of the 3 trigger labels (agent:update-branch / agent:merge / agent:fix).
2. Confirm the workflow's "Fetch PR head sandcastle.config.json" step succeeds and the "Proxy preflight" step's should_run/reason reflects the PR's config, not dev's.
3. Repeat with the label applied to a PR that does NOT touch sandcastle.config.json, confirming behavior is unchanged from today (regression check).

Acceptance Criteria

• Both scenarios produce the expected should_run/reason pair
• No unexpected workflow failures in either run
• No secrets logged in the fetch step's output