docs: fix inaccurate compile-time permissions.write validation claim in debug prompt

[github-actions]

Agent Documentation Update

Findings

Area	Issue	File(s)
accuracy	prompts/debug-ado-agentic-workflow.md claimed the compiler validates that permissions.write is set when write-bearing safe outputs are configured. No such compile-time check exists.	prompts/debug-ado-agentic-workflow.md

Applied Fixes

• Replaced the incorrect "Compile-time validation" bullet (which falsely told agents to "recompile to fix this") with an accurate statement: the compiler emits a valid pipeline regardless, defaulting to $(System.AccessToken) for Stage 3. Permission failures are purely a runtime concern.

Notes

Verified against:

• src/compile/common.rs — generate_acquire_ado_token returns an empty string (no script step) when service_connection is None, with no error or warning.
• src/compile/agentic_pipeline.rs — no validation that checks for a missing permissions.write when safe outputs are present.
• src/compile/agentic_pipeline.rs (line 196+) / common.rs line 1811 — confirms $(System.AccessToken) is the hardcoded default fallback for the Stage 3 write token.

The create prompt (prompts/create-ado-agentic-workflow.md) already stated the correct behavior: "The compiler no longer requires permissions.write for write-bearing safe outputs — the executor defaults to $(System.AccessToken)." The debug prompt contradicted this with a claim that could mislead an agent into thinking a recompile would fix a runtime permission failure.

---

Created by the agent-documentation maintainer workflow.

Generated by Agent Documentation Maintainer · 171.4 AIC · ⌖ 11.9 AIC · ⊞ 8.7K · ◷