Fix broken integration tests by stripping YAML comment header before assertions

[Copilot]

Two integration tests (TestTopLevelGitHubTokenPrecedence and TestNeutralToolsIntegration) were failing because they check that certain patterns don't appear in compiled YAML output, but the generated files now include a comment header containing the original frontmatter—which contains the exact strings being checked against.

Changes

• pkg/testutil/tempdir.go: Add StripYAMLCommentHeader() helper that extracts only the actual YAML content, skipping leading comment lines
• pkg/testutil/tempdir_test.go: Add unit tests for the new helper
• pkg/workflow/*_integration_test.go: Update both failing tests to use the shared helper before performing string assertions

Example

// Before: matches strings in comment header (false positive)
if strings.Contains(yamlContent, "github-token: ${{ secrets.TOPLEVEL_PAT }}") {
    t.Error("...")
}

// After: checks only actual YAML content
yamlContentNoComments := testutil.StripYAMLCommentHeader(yamlContent)
if strings.Contains(yamlContentNoComments, "github-token: ${{ secrets.TOPLEVEL_PAT }}") {
    t.Error("...")
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

please fix the broken test cases on main: Failing tests:

TestTopLevelGitHubTokenPrecedence/safe-outputs_github-token_overrides_top-level
TestNeutralToolsIntegration

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.