docs(work): scaffold sandcastle-subscription-auth-v1 epic

docs/work/sandcastle-subscription-auth-v1/_epic.md

@@ -0,0 +1,29 @@
+---
+id: sandcastle-subscription-auth-v1
+prd: null
+title: Sandcastle subscription auth as primary flow
+type: epic
+status: in-progress
+features: [tooling, ci]
+created: 2026-05-13
+---
+
+## Goal
+
+Subscription-based Claude Code auth (via host `~/.claude` mount) becomes
+the default for `pnpm work dispatch --execute`. API-key auth remains as a
+fallback. Works for any developer who has run `claude login` on their
+host — zero per-user configuration in the repo.
+
+## Why
+
+The sandcastle community has explicitly rejected native subscription
+support (issue #191, wontfix). But the host's `~/.claude/` directory
+contains the logged-in session; mounting it into the sandbox lets the
+container's Claude Code CLI use that session. This pattern is
+environment-agnostic (each developer has their own `~/.claude`) and
+spends zero per-task agent tokens for Pro/Max subscribers.
+
+## Stories
+
+- [ ] [01 — Subscription-first dispatch + Dockerfile + docs](01-subscription-first/_story.md)