docs(work): scaffold sandcastle-subscription-auth-v1 epic

docs/work/sandcastle-subscription-auth-v1/01-subscription-first/_story.md

@@ -0,0 +1,21 @@
+---
+id: 01-subscription-first
+epic: sandcastle-subscription-auth-v1
+title: Subscription-first dispatch — mount ~/.claude, install claude CLI, docs
+type: technical-story
+status: in-progress
+feature: tooling
+depends-on: []
+blocks: []
+---
+
+## Tasks
+
+- [ ] Story scaffold
+- [ ] Update .sandcastle/Dockerfile to install @anthropic-ai/claude-code CLI
+- [ ] Update scripts/work/dispatch.mjs: resolveClaudeAuth helper + sandbox mount + fallback to API key
+- [ ] Tests for resolveClaudeAuth
+- [ ] Update runbook "Using Sandcastle" section: subscription is primary flow
+- [ ] Update ADR-019: subscription auth as primary, API key as fallback
+- [ ] Update .env.example + .sandcastle/.env.example: reframe ANTHROPIC_API_KEY as fallback
+- [ ] Final verification + closeout