Upgrade agentic workflows

[pelikhan]

This PR upgrades agentic workflows by applying the latest codemods, updating GitHub Actions versions, and recompiling all workflows.
View gh-aw release v0.92.0

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 target tools absent from 23-tool catalog (only read tools exposed)	BLOCKED	⚠️
C	CLI	reads (github CLI proxy)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh not authenticated — no GH_TOKEN; writes not attempted	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh not authenticated — not attempted	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: gh-aw's tools.github: block always sets GITHUB_READ_ONLY=1, so the backend never registers write tools — their absence from the catalog proves backend config, not gateway-level DIFC enforcement. Parts D/E: gh auth status reported "You are not logged into any GitHub hosts" (no GH_TOKEN in this run), so REST/GraphQL write attempts could not be made — token-scope boundary unverified this run. No writes leaked on any surface that was reachable.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[Copilot]

🟡 Changes recommended

The stress workflow must be regenerated to preserve its configured compile-time imports.

1 open finding

• Generated stress plan leaves shared prompts as runtime imports · New

What changed in this PR

Refreshes the repository’s agentic workflow artifacts for gh-aw v0.92.0.

Changes:

• Recompiles the default read-only stress workflow.
• Updates the CodeQL upload action pin to v4.39.0.
• Adds run-analysis and checkout documentation references.

File	Description
.github/​workflows/​readonly-stress-default.lock.yml	Replaces embedded shared prompts with runtime imports.
.github/​skills/​agentic-workflows/​SKILL.md	Adds two workflow documentation references.
.github/​aw/​actions-lock.json	Updates the CodeQL upload-SARIF version and SHA.

🧠 Review effort: Max

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.