Feat/deepagents research worker

[gvaibhav]

Related Issue

Closes #110

Description

Adds a new community recipe at examples/recipes/community/deep-research-worker/ for asynchronous long-running research with a host-side DeepAgents worker and a narrow worker-only sandbox policy.

This change:

• adds the deep-research-worker community recipe, including bring-up, teardown, static verification, policy, skill, worker service, and env placeholders
• documents provenance, support boundary, requirements, secrets, verification, limitations, and third-party obligations for the recipe
• adds the recipe to examples/README.md
• updates THIRD-PARTY-NOTICES for the new packaged Python dependencies
• hardens the install flow so the recipe prefers additive policy installation and does not copy the worker secret into sandbox-visible wrapper files

Verification

• python3 scripts/check_license_headers.py --check
• python3 scripts/check_label_taxonomy.py --check when governance metadata changes. It is not changed hence left unchecked.
• git diff --check
• Relevant example setup or syntax checks

Commands run:

• python3 scripts/check_license_headers.py --check -> passed
• git diff --check upstream/main...HEAD -> passed
• bash examples/recipes/community/deep-research-worker/scripts/verify.sh -> passed

Not run:

• python3 scripts/check_label_taxonomy.py --check because this change does not modify governance metadata or label taxonomy inputs

Documentation Writer Review

• Documentation writer review completed for the final changes
• Result: docs-updated
• Evidence or justification: Updated examples/README.md and examples/recipes/community/deep-research-worker/README.md
• Reviewer: Vaibhav
• Changed user-facing text follows the writing guide and controlled-word list.
• A public contributor can understand the changed text without internal company context.
• I reviewed any agent-generated text before submission.

Release And Compliance

• No secrets or credentials are included, including API keys, access tokens, passwords, local .env files, private certificates, or token caches.
• No nonpublic project names, environment names, hostnames, URLs, ticket identifiers, workspace paths, logs, screenshots, or configuration values are included.
• Third-party dependency changes are reflected in THIRD-PARTY-NOTICES.
• Public content uses sanitized examples and placeholders instead of private values.
• I added my DCO sign-off declaration to this pull request description.

Signed-off-by: Vaibhav gvaibhav@hotmail.com

[apurvvkumaria]

Thank you for the contribution. The structure and documentation are a strong start, but the current implementation has several runtime and security blockers. Please address the inline comments and add behavioral tests for authentication, rubric execution, cancellation/retry behavior, and restart recovery before this is merged.

[apurvvkumaria]

Thank you for the hardening update. The rubric, API authentication, research-only default, and restart recovery changes are substantial improvements, and all 14 behavioral tests pass locally. Three remaining runtime and security blockers are noted inline.