Refactor Rate Limiting Best Practices into scannable numbered guidance

[Copilot]

The Best Practices section in rate-limiting-controls.md was a dense run-on paragraph containing four distinct operational recommendations. This change restructures that content into a scan-friendly format without changing meaning.

• What changed

  • Replaced the single prose paragraph under ## Best Practices with a 4-item numbered list.
  • Added bold lead-ins per item to improve rapid scanning for security/configuration workflows.

• Guidance preserved (no semantic change)

  • Start conservative, then increase limits as needed.
  • Use environments for high-risk operations.
  • Layer controls across rate limits, concurrency, timeouts, and safe outputs.
  • Monitor run and cancellation signals to tune controls.

• Resulting structure (example)

  1. **Start conservative:** Begin with lower limits and increase as needed.
  2. **Use environments for high-risk operations:** Require environments for workflow dispatches, cross-repo operations, and production systems.
  3. **Layer controls:** Combine rate limiting with concurrency, timeouts with stop-after, and safe output limits with environments.
  4. **Monitor signals:** Track workflow runs, safe output logs, and rate limit cancellations to identify needed adjustments.