feat: add shared PMG (Package Manager Guard) pre-step for supply chain protection (#34672)

Author: Copilot

.github/aw/actions-lock.json

@@ -198,6 +198,11 @@
       "version": "v1.308.0",
       "sha": "97ecb7b512899eb71ab1bf2310a624c6f1589ac6"
     },
+    "safedep/pmg@v1": {
+      "repo": "safedep/pmg",
+      "version": "v1",
+      "sha": "46cc70db535107183c9e752bb55d1d5c5f1a9290"
+    },
     "super-linter/super-linter@v8.6.0": {
       "repo": "super-linter/super-linter",
       "version": "v8.6.0",

.github/workflows/agentic-token-audit.lock.yml

@@ -69,6 +69,8 @@ steps:
         echo '{"runs":[],"summary":{}}' > /tmp/gh-aw/agent/token-audit/workflow-logs.json
       fi
 timeout-minutes: 25
+imports:
+  - shared/pmg.md
 source: githubnext/agentic-ops/workflows/agentic-token-audit.md@e10687ae8f19a5b37b061db524be27948568c411
 ---
 

.github/workflows/agentic-token-audit.md

@@ -16,6 +16,7 @@ network:
     - python
     - github-actions
 imports:
+  - shared/pmg.md
   - uses: shared/discussions-data-fetch.md
   - uses: shared/repo-memory-standard.md
     with: