feat: content redaction for public-facing safe-outputs

.github/workflows/approach-validator.md

@@ -44,6 +44,7 @@ safe-outputs:
     max: 1
     allowed: ["awaiting-approach-approval", "approach-approved", "approach-rejected"]
   noop:
+  content-redaction: "Do not disclose security vulnerabilities, internal credentials, or confidential information in public-facing output."
   messages:
     footer: "> 🔬 *Approach validated by [{workflow_name}]({run_url})*{ai_credits_suffix}{history_link}"
     run-started: "🔬 [{workflow_name}]({run_url}) is analyzing the proposed approach on this {event_type}..."

.github/workflows/archie.md

@@ -35,6 +35,7 @@ tools:
 safe-outputs:
   add-comment:
     max: 1
+  content-redaction: "Do not disclose security vulnerabilities, internal credentials, or confidential information in public-facing output."
   messages:
     footer: "> 📊 *Diagram rendered by [{workflow_name}]({run_url})*{ai_credits_suffix}{history_link}"
     footer-workflow-recompile: "> 🔧 *Workflow sync report by [{workflow_name}]({run_url}) for {repository}*"

.github/workflows/auto-triage-issues.md

@@ -57,6 +57,7 @@ safe-outputs:
     close-older-discussions: true
     max: 1
   noop:
+  content-redaction: "Do not disclose security vulnerabilities, internal credentials, or confidential information in public-facing output."
 timeout-minutes: 15
 features:
   gh-aw-detection: true

.github/workflows/brave.md

@@ -23,6 +23,7 @@ imports:
 safe-outputs:
   add-comment:
     max: 1
+  content-redaction: "Do not disclose security vulnerabilities, internal credentials, or confidential information in public-facing output."
   messages:
     footer: "> 🦁 *Search results brought to you by [{workflow_name}]({run_url})*{ai_credits_suffix}{history_link}"
     footer-workflow-recompile: "> 🔄 *Maintenance report by [{workflow_name}]({run_url}) for {repository}*"