docs: surface sandcastle image-build step (one-time setup)

Closes the gap the user hit running `pnpm work decompose --execute`:
sandcastle errored with `Image 'sandcastle:template-vertical' not
found locally. Build it first with 'sandcastle docker build-image'`,
but neither the README nor the runbook documented this step.

README.md: new "Sandcastle setup (one-time)" section after Quick
reference. Three commands (docker info, build-image, auth) — the
minimum needed to make dispatch work. Links to the runbook for the
full lifecycle.

docs/guides/runbook.md: Prerequisites in "Using Sandcastle" grow
from 4 to 5 items. New step 2 walks through `sandcastle docker
build-image`, quotes the exact "Image not found locally" error so
agents searching for the string land on the fix, and shows the
remove-image + rebuild flow for Dockerfile edits.

.sandcastle/README.md: new "Build the sandbox image (one-time)"
section parallel to the env section, cross-linking to the runbook.

scripts/work/decompose.mjs + scripts/work/dispatch.mjs: when the
sandcastle error message matches the "Image '.+' not found locally"
pattern, the dispatcher now prints the build-image command inline
above the generic "See runbook" line. The error stack itself remains
unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -23,6 +23,43 @@ pnpm work status       # docs/work/ epic + story state
 docker compose up -d   # Start PostgreSQL
 ```
 
+## Sandcastle setup (one-time)
+
+Required only if you'll use `pnpm work dispatch --execute` or `pnpm work decompose <id> --execute` (agent dispatch). The dispatch loop runs the implementer / reviewer / decomposer agents inside an isolated Docker sandbox; the image is built once locally.
+
+```bash
+# 1. Ensure Docker is running
+docker info >/dev/null
+
+# 2. Build the sandcastle image (reads .sandcastle/Dockerfile)
+pnpm exec sandcastle docker build-image
+# Tags as: sandcastle:template-vertical (derived from the root package.json name)
+
+# 3. Pick ONE auth path:
+#    (a) Recommended — Claude Pro/Max subscription:
+claude login           # one-time; ~/.claude/ becomes the auth source
+#    (b) Fallback — API key:
+export ANTHROPIC_API_KEY=sk-ant-...
+```
+
+After the image exists, dispatch flows work without further setup:
+
+```bash
+pnpm work dispatch                                    # print plan (safe anywhere)
+pnpm work dispatch --execute                          # actually dispatch via sandcastle
+pnpm work decompose <prd-id>                          # print decompose plan
+pnpm work decompose <prd-id> --execute                # decompose an approved PRD
+```
+
+To rebuild the image after changing `.sandcastle/Dockerfile`:
+
+```bash
+pnpm exec sandcastle docker remove-image
+pnpm exec sandcastle docker build-image
+```
+
+See [`docs/guides/runbook.md` → Using Sandcastle](./docs/guides/runbook.md#using-sandcastle-for-agent-dispatch) for the full dispatch lifecycle, auth modes, and troubleshooting.
+
 ## Documentation map
 
 - **[`docs/guides/runbook.md`](./docs/guides/runbook.md)** — start here