fix(workflows): harden recurring agentic incidents (#1529)

Author: Copilot

.github/workflows/doc-freshness-check.lock.yml

@@ -46,6 +46,10 @@ agent files, and any tool that ingests repo context), so they must be
 > **Out of scope — do not touch:** `README.md` and other human-facing site
 > content are owned by the separate `docs-writer` workflow. Never edit files
 > outside `AGENTS.md` and `docs/**` in this workflow.
+> Treat Rust, TypeScript, YAML, and other non-documentation files as read-only
+> evidence. If fixing documentation drift appears to require a source-code
+> change, do not make that code change in this workflow; either document the
+> current behavior accurately or emit `noop` / `report-incomplete`.
 
 ## Documentation Model
 
@@ -227,6 +231,10 @@ There is no build step for these markdown docs, but before opening a PR:
 - Confirm all links you added or moved resolve to real files/anchors.
 - Confirm all modified files are within `AGENTS.md`, `docs/**`, or `prompts/**`.
   If a needed fix is outside this scope, do not edit it in this workflow.
+- Before calling `create-pull-request`, run `git diff --name-only` and remove or
+  revert any source-code/configuration changes outside the allowed documentation
+  paths. The safe-output allowlist is a backstop, not a substitute for this
+  check.
 
 ## Pull Request Format
 

.github/workflows/doc-freshness-check.md

@@ -110,6 +110,11 @@ EOF
 
 If you find meaningful gaps, implement them directly in `tests/**` instead of filing an issue.
 For this workflow, **high-value** means coverage for security-sensitive paths, error-handling branches, or previously untested public behavior.
+Only edit test files under `tests/**`. Treat `src/**`, workflow files, and other
+production/configuration files as read-only while diagnosing coverage gaps. If a
+useful test exposes a production bug or requires a production-code fix, do not
+include that source change in this workflow's PR; skip that candidate and choose
+a test-only gap or emit `noop`.
 
 Scope limits per run:
 - Add or update at most **3** high-value tests.
@@ -121,8 +126,12 @@ Before opening a PR, run:
 ```bash
 cargo test 2>&1
 cargo clippy --all-targets --all-features 2>&1
+git diff --name-only
 ```
 
+If `git diff --name-only` lists anything outside `tests/**`, revert those files
+before calling `create-pull-request`.
+
 Open at most one pull request via `create-pull-request` when tests were added and checks passed.
 Note: this repository requires `GH_AW_CI_TRIGGER_TOKEN` for PR CI triggers when using `create-pull-request`.
 PRs opened via the default `GITHUB_TOKEN` do not trigger follow-up workflows.

.github/workflows/test-gap-finder.lock.yml

@@ -35,7 +35,7 @@ safe-outputs:
     required-title-prefix: "[deps-release-notes] "
     max: 10
     state-reason: "not_planned"
-max-ai-credits: -1
+max-ai-credits: 1500
 max-daily-ai-credits: -1
 ---