fix(ci): allow doc freshness workflow to update AGENTS.md

[Copilot]

Summary

The Documentation Freshness Check workflow failed in safe_outputs because generated docs patches touched AGENTS.md, which is protected by default for create_pull_request. This change scopes an explicit exception for that workflow so doc-drift fixes can be proposed without weakening broader protections.

• Workflow policy adjustment

  • Updated .github/workflows/doc-freshness-check.md to allow AGENTS.md in safe-outputs.create-pull-request.allowed-files.

• Compiled workflow sync

  • Recompiled .github/workflows/doc-freshness-check.lock.yml so runtime safe-output handler config includes the same allowlist.

• Effective config change (excerpt)

  safe-outputs:
    create-pull-request:
      max: 1
      allowed-files:
        - AGENTS.md

Test plan

doc-freshness-check workflow definition was recompiled/validated to confirm the generated lock config carries allowed_files: ["AGENTS.md"] for create_pull_request.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.68.1
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.68.1 --jq .object.sha -C debuginfo=2 --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C 887.�� ipeline-filter-a--error-format=json t6k.rcgu.o bin/rustc t6k.rcgu.o t6k.rcgu.o t6k.rcgu.o bin/rustc (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.68.1 --jq .object.sha target/debug/deps/cli_tests-ed0b7304d63a7e6f.18k6h7971v4iunaqu3s0y15b7.1e82akx.rcgu.o target/debug/deps/cli_tests-ed0b7304d63a7e6f.1jdgsuuy78aa4hkz1krzxiwb2.1e82akx.rcgu.o bin/rustc target/debug/depcc .o .o bin/rustc .o .o .o bin/rustc .o .o .o bin/rustc (http block)
• spsprodeus21.vssps.visualstudio.com
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-a3f02ec5a93c8182 /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-a3f02ec5a93c8182 --hash-style=gnu --as-needed -shared -z relro -o /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/libado_aw_derive-200f38d8081bc/home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/compiler_tests-404504f8280230b7.331dlyqpp92h89r8divrvps39.0po1tak.rcgu.o /usr/lib/gcc/x86_64-linux-gnu/13/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/13/crtbeginS.o -L/home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/rustcVThTdn/raw-dylibs -L/home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_64-REDACTED-linux-gnu/lib o-aw�� ib e2.rlib f/idna-1.1.0/src-m c1063f.rlib s/futures_macro--flavor s/futures_macro-gnu known-linux-gnu/-plugin (dns block)
• spsprodweu4.vssps.visualstudio.com
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-a3f02ec5a93c8182 /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-a3f02ec5a93c8182 --hash-style=gnu --as-needed -shared -z relro -o /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/libado_aw_derive-200f38d8081bc/home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/compiler_tests-404504f8280230b7.331dlyqpp92h89r8divrvps39.0po1tak.rcgu.o /usr/lib/gcc/x86_64-linux-gnu/13/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/13/crtbeginS.o -L/home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/rustcVThTdn/raw-dylibs -L/home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_64-REDACTED-linux-gnu/lib o-aw�� ib e2.rlib f/idna-1.1.0/src-m c1063f.rlib s/futures_macro--flavor s/futures_macro-gnu known-linux-gnu/-plugin (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)