fix(workflows): allow doc-freshness-check to patch safeoutput source files

[Copilot]

Summary

The Documentation Freshness Check workflow failed during safe output processing because its PR patch touched src/safeoutputs/create_work_item.rs and src/safeoutputs/update_work_item.rs, which were not permitted by create-pull-request.allowed-files.

• Safe output policy alignment
  • Updated .github/workflows/doc-freshness-check.md to allow the two safeoutput Rust files that the workflow currently audits/edits.
• Compiled workflow sync
  • Regenerated .github/workflows/doc-freshness-check.lock.yml so runtime GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG matches source front matter.

safe-outputs:
  create-pull-request:
    allowed-files:
      - AGENTS.md
      - README.md
      - docs/**
      - prompts/**
      - src/safeoutputs/create_work_item.rs
      - src/safeoutputs/update_work_item.rs

Test plan

Template section retained. Validation details are captured in CI/tooling outputs for this PR.