docs: Update health check docs for LLM delegation [doc-updater]

[james-in-a-box]

Update documentation to reflect the architectural change in PR #868 where the Tier 2 AgentInspectorCheck was refactored to delegate LLM API calls to sandbox containers instead of calling the Anthropic API directly from the orchestrator.

This maintains the security boundary — the orchestrator (which has Docker and pipeline credentials) never processes LLM responses. All LLM calls happen inside sandbox containers, which are untrusted and isolated.

Documentation updates:

• orchestrator/health_checks/README.md — Rewrote AgentInspectorCheck section to describe container delegation pattern, added security boundary explanation, removed stale API configuration
• docs/architecture/orchestrator.md — Updated Tier 2 health check description to mention sandbox delegation
• docs/development/STRUCTURE.md — Added egg-health-inspect to sandbox bin/ listing and LLM API boundary enforcement to scripts description

Triggered by: #868 (7564616)

Authored-by: egg

[egg-reviewer]

No agent-mode design concerns.

This documentation update reflects an architecture that strengthens agent-mode alignment: delegating LLM calls from the orchestrator to sandbox containers enforces the security boundary technically (not via prompt instructions), consistent with the core principle that the sandbox is the constraint. The structured JSON verdict is appropriate since it's consumed programmatically by the orchestrator, not by humans. CI enforcement of the API boundary via check-llm-api-calls.py is the right pattern.

— Authored by egg

[egg-reviewer]

Documentation is accurate and complete. Verified all claims against the implementation:

• orchestrator/health_checks/tier2/agent_inspector.py implements the container delegation pattern as described
• sandbox/bin/egg-health-inspect exists and calls the Anthropic API from inside the sandbox
• scripts/check-llm-api-calls.py exists and enforces the LLM API boundary at CI time
• EGG_INSPECTOR_CONTEXT env var is used in both the orchestrator (write) and inspector script (read)
• ANTHROPIC_API_KEY and ANTHROPIC_BASE_URL have no remaining references in orchestrator/, so removing them from the config table is correct
• The old retry sentence ("retries once on transient failures") was correctly removed — the container delegation path has no retry logic

One minor observation (non-blocking): The old doc mentioned the retry behavior, and the new architecture intentionally drops it. If container-level retries are planned for the future, a brief note like "no retries — container failures degrade immediately" could make that explicit. But the current wording ("Container failures ... always degrade to HEALTHY with a warning") is clear enough on its own.

No issues found.

— Authored by egg

[james-in-a-box]

egg review completed. View run logs

1 previous review(s) hidden.