docs: fix update-work-item target field documented as optional default (#514)

The target field for update-work-item is required (compile-time
validation rejects configs that omit it) but was documented with a
comment saying '"*" (default)' in safe-outputs.md, incorrectly
implying it has a default value.

Changes:
- docs/safe-outputs.md: change comment from '"*" (default)' to
  'Required —' and add a Note block matching the pattern used by
  comment-on-work-item
- prompts/create-ado-agentic-workflow.md: move target to the top of
  the update-work-item example block and add a 'Required' comment,
  consistent with how comment-on-work-item shows its target field

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: github-actions[bot]

docs/safe-outputs.md

@@ -108,14 +108,16 @@ safe-outputs:
     title-prefix: "[bot] "    # only update work items whose title starts with this prefix
     tag-prefix: "agent-"      # only update work items that have at least one tag starting with this prefix
     max: 3                    # maximum number of update-work-item outputs allowed per run (default: 1)
-    target: "*"               # "*" (default) allows any work item ID, or set to a specific work item ID number
+    target: "*"               # Required — "*" allows any work item ID, or set to a specific work item ID number
     area-path: true           # enable area path updates (default: false)
     iteration-path: true      # enable iteration path updates (default: false)
     assignee: true            # enable assignee updates (default: false)
     tags: true                # enable tag updates (default: false)
     allowed-tags: []          # Optional — restrict which tags the agent can set (empty = any; supports * wildcards like "agent-*")
 ```
 
+**Note:** The `target` field is required. If omitted, compilation fails with an error. This ensures operators are intentional about which work items agents can update.
+
 **Security note:** Every field that can be modified requires explicit opt-in (`true`) in the front matter configuration. If the `max` limit is exceeded, additional entries are skipped rather than aborting the entire batch.
 
 ### create-pull-request

prompts/create-ado-agentic-workflow.md

@@ -320,10 +320,10 @@ safe-outputs:
     target: "TeamProject\\AreaPath"   # Required — scopes which work items can be commented on
     max: 3
   update-work-item:
+    target: "*"                       # Required — "*" allows any work item, or set to a specific ID number
     status: true                      # Each updatable field requires explicit opt-in
     title: true
     max: 5
-    target: "*"
   add-pr-comment:
     max: 10
   queue-build: