[plan] Ensure `noop` safe-output tool is available to all workflows by default

[github-actions]

Objective

Make noop available as a default safe-output tool in all compiled workflows so agents can always signal a no-op completion without misconfiguration.

Context

From audit discussion #18635 (2026-02-26→2026-02-27):

Note on noop missing: Duplicate Code Detector explicitly reported needing to call noop (no duplicates found) but the tool wasn't in its allowed list. This is a workflow misconfiguration — noop should be available to all workflows as a no-op completion signal.

Currently, noop must be explicitly added to each workflow's allowed safe-output tools list. When it's missing, agents that find nothing to do (the correct behavior) cannot signal completion properly.

Approach

1. Find where safe-output allowed tools are determined during compilation in pkg/workflow/
2. Find where the (safe-output-tools) system prompt section is constructed (lists available tools to the agent)
3. Ensure noop is always included in the allowed tools list, regardless of the workflow's explicit tool configuration
4. Update compilation logic so noop is injected as a baseline tool even if not specified in frontmatter
5. Add or update a test verifying noop is always present in compiled workflow tool lists

Files to Investigate

• pkg/workflow/ — compiler and safe-output tool list generation
• .github/workflows/duplicate-code-detector.md — the affected workflow (add noop as a fix)

Acceptance Criteria

• Every compiled workflow includes noop in its safe-output tools list
• Adding noop does not break workflows that already list it explicitly (no duplicates)
• Duplicate Code Detector workflow explicitly has noop available
• Unit test verifies noop is always present after compilation
• make agent-finish passes

Generated by Plan Command for issue #discussion #18635

• expires on Mar 1, 2026, 6:37 AM UTC