[instructions] Sync safe-outputs.md with current code (v0.76.1)

[github-actions]

[instructions] Sync safe-outputs.md with current code

Summary

Documentation-only sync of .github/aw/safe-outputs.md to reflect the current state of the safe-outputs implementation. No source code was changed.

---

What changed

.github/aw/safe-outputs.md — upload-artifact config & new create-code-scanning-alert options

upload-artifact config block (breaking)

Before	After
default-retention-days + max-retention-days (two separate fields)	Single fixed retention-days field
skip-archive was documented outside the config block	skip-archive moved inside the config block
Unclear whether agents could override retention	Explicit clarification: agents cannot override these fields

New create-code-scanning-alert config options
Added documentation for four new operator-controlled fields:

Field	Purpose
driver	Identifies the scanning tool/driver
github-token	Token used to post alerts
target-repo	Repository where alerts are created
allowed-repos	Allowlist of repos agents may target

---

Impact assessment

Area	Impact	Notes
Operator config schemas	Breaking	default-retention-days / max-retention-days replaced by retention-days; existing configs referencing the old fields will need updating
Agent behaviour	None	Docs clarify existing enforcement; no behavioural change
Source code	None	Documentation-only commit

---

Breaking change detail

upload-artifact retention fields renamed/merged

Operators using default-retention-days or max-retention-days in their safe-outputs configuration must migrate to the single retention-days field. The agent is explicitly prohibited from overriding this value.

---

Checklist

• Documentation reflects current code behaviour
• Breaking change noted above
• Operator migration guide / CHANGELOG entry (recommended before merge)

Generated by PR Description Updater for issue #35163 · sonnet46 898.3K · ◷