Fix gh-aw docs PR push permissions

[David Pine (IEvangelist)]

Description

The first documentation recovery after #19055 generated the correct release/13.5 patch, but gh-aw could not push the Aspire docs branch. In v0.85.4, an actions/checkout entry in safe-outputs.steps overwrites the contents: write permission required by create-pull-request with contents: read. Both branch creation paths then fail with 403, and gh-aw creates a fallback issue instead of a docs PR.

This removes the redundant custom target-repository checkout from both cross-repository docs workflows. gh-aw already generates the _repos/aspire.dev checkout for create-pull-request; keeping that checkout compiler-owned preserves the handler-derived contents: write scope without giving the agent job write access.

The compiler defect is tracked by github/gh-aw#50905. The recovery evidence is run 31116010823 and its fallback aspire.dev#1432.

All eight gh-aw workflows were recompiled with the checksum-verified v0.85.4 binary. Schema validation succeeded, and the generated pr-docs-check and release-update-support-mdx safe-output jobs now mint permission-contents: write.

Related to #19054

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19062

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19062"

[Copilot]

Pull request overview

Removes redundant gh-aw checkouts that downgraded permissions and prevented documentation PR branches from being pushed.

Changes:

• Removes custom target-repository checkout steps.
• Regenerates workflows with contents: write.
• Preserves compiler-managed checkout and credential handling.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/pr-docs-check.md	Removes redundant docs checkout configuration.
.github/workflows/pr-docs-check.lock.yml	Regenerates workflow permissions and checkout steps.
.github/workflows/release-update-support-mdx.md	Removes redundant support-docs checkout configuration.
.github/workflows/release-update-support-mdx.lock.yml	Regenerates workflow with write permissions.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.