docs(work): close sandcastle-subscription-auth-v1 epic

docs/work/sandcastle-subscription-auth-v1/01-subscription-first/_story.md

@@ -3,7 +3,7 @@ id: 01-subscription-first
 epic: sandcastle-subscription-auth-v1
 title: Subscription-first dispatch — mount ~/.claude, install claude CLI, docs
 type: technical-story
-status: in-progress
+status: done
 feature: tooling
 depends-on: []
 blocks: []
@@ -11,11 +11,11 @@ blocks: []
 
 ## Tasks
 
-- [ ] Story scaffold
-- [ ] Update .sandcastle/Dockerfile to install @anthropic-ai/claude-code CLI
-- [ ] Update scripts/work/dispatch.mjs: resolveClaudeAuth helper + sandbox mount + fallback to API key
-- [ ] Tests for resolveClaudeAuth
-- [ ] Update runbook "Using Sandcastle" section: subscription is primary flow
-- [ ] Update ADR-019: subscription auth as primary, API key as fallback
-- [ ] Update .env.example + .sandcastle/.env.example: reframe ANTHROPIC_API_KEY as fallback
-- [ ] Final verification + closeout
+- [x] Story scaffold
+- [x] Update .sandcastle/Dockerfile to install @anthropic-ai/claude-code CLI
+- [x] Update scripts/work/dispatch.mjs: resolveClaudeAuth helper + sandbox mount + fallback to API key
+- [x] Tests for resolveClaudeAuth
+- [x] Update runbook "Using Sandcastle" section: subscription is primary flow
+- [x] Update ADR-019: subscription auth as primary, API key as fallback
+- [x] Update .env.example + .sandcastle/.env.example: reframe ANTHROPIC_API_KEY as fallback
+- [x] Final verification + closeout