Teach agent builder packed frontends

agent_builder/skills/agent-quality-review/SKILL.md

@@ -16,6 +16,7 @@ Every generated project needs:
 - `requirements.txt`
 - Optional `skills/<skill-name>/SKILL.md` bundles for nontrivial DeepAgents
   behavior
+- Optional `frontend/` source when the agent ships a packed app
 
 Run `list_agent_files` and read the files that matter. If the project was
 deployed before, use `sync_agent_workspace_from_repo` before editing when the
@@ -66,11 +67,34 @@ runtime:
 Use `runtime.apt_packages` only for Debian system binaries. Python packages
 belong in `requirements.txt`.
 
+If a packed frontend is declared, verify the manifest and files line up:
+
+```yaml
+frontend:
+  path: frontend
+  build: npm run build
+  dist: dist
+  mount: /app
+  auth: inherit
+```
+
+For React/Vite frontends, expect `frontend/package.json`,
+`frontend/vite.config.js`, `frontend/src/App.jsx`, and `frontend/src/a2a.js`.
+For static frontends, expect `frontend/dist/index.html`. The browser code must
+not contain platform secrets, provider keys, hard-coded deployment URLs, or
+private stack details. It should load `/app/config.json`, use
+`/app/a2a-client.js` or generated config endpoints, and call only the public
+`@skill` schemas.
+
 ## Sandbox And Live Card
 
 Always run `test_agent_in_sandbox(name)` before deploy. Treat nonzero exit as
 source failure, then read stderr, edit, and rerun.
 
+When a frontend is present, inspect the sandbox output's `a2a frontend info`.
+For React apps, make sure `frontend/package.json` defines a build script and
+the deployed build process can produce `frontend/dist/index.html`.
+
 After `cp_deploy_tarball`, compare `live_skills[].input_schema` with the
 actual public `@skill` signatures. If a live schema is missing an argument or
 shows an old shape, refresh or redeploy until the live Agent Card matches the