feat(workflows): make test-gap-finder open PRs for coverage gaps

[Copilot]

Summary

The test-gap-finder workflow now contributes missing tests via pull request instead of opening an issue report. This keeps outcomes actionable by moving from “identify gaps” to “land targeted test coverage changes.”

• Behavior change

  • Replaced issue-oriented output with PR-oriented output in workflow front matter and instructions.
  • Updated run guidance to implement up to three focused tests directly in tests/**.

• Safety and scope controls

  • Configured safe-outputs to create-pull-request with max: 1 and allowed-files: ["tests/**"].
  • Preserved issues: read permission required by the configured GitHub toolset while shifting write behavior to PR creation.

• Authoring guidance updates

  • Rewrote Step 5 from “create issue if warranted” to “implement tests + open PR.”
  • Added explicit high-value test criteria (security-sensitive paths, error branches, untested public behavior).
  • Clarified GH_AW_CI_TRIGGER_TOKEN prerequisite for PR CI triggers and made noop tool invocation explicit when no safe additions are found.

• Generated artifact sync

  • Regenerated test-gap-finder.lock.yml from the updated .md workflow definition so runtime behavior matches the new PR-first policy.

safe-outputs:
  create-pull-request:
    max: 1
    allowed-files:
      - "tests/**"

Test plan

• Recompiled the workflow (gh aw compile test-gap-finder) and updated the lock file with no compile warnings.