fix(workflow): add protected-files fallback-to-issue for doc-freshness-check

[Copilot]

Summary

The doc-freshness-check workflow fails when its patch includes AGENTS.md because gh-aw classifies agent instruction files as protected, blocking PR creation even though AGENTS.md is in allowed-files.

Adds protected-files: fallback-to-issue to the create-pull-request safe-output config so the workflow creates a review issue instead of failing outright when protected files are in the patch. Lock file recompiled.

safe-outputs:
  create-pull-request:
    max: 1
    protected-files: fallback-to-issue
    allowed-files:
      - AGENTS.md
      # ...

Test plan

• gh aw compile doc-freshness-check — compiled successfully with 0 errors, 0 warnings
• Verified frontmatter hash updated in lock file

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.68.1
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.68.1 --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)