fix(compile): reject unknown front-matter fields with deny_unknown_fields

Add #[serde(deny_unknown_fields)] to FrontMatter so typos like
'safeoutputs:' (instead of 'safe-outputs:') or top-level 'schedule:'
(instead of 'on: schedule:') produce a clear compile error rather than
being silently ignored.

Previously, unknown YAML keys were silently dropped by serde, which
meant write-requiring safe-outputs could bypass the
validate_write_permissions check entirely, leading to confusing runtime
errors (e.g. 'AZURE_DEVOPS_ORG_URL not set').

Also fixes all example files and docs that incorrectly used top-level
'schedule:' instead of 'on: schedule:'.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jamesadevine

README.md

@@ -81,7 +81,8 @@ description: "Checks for outdated dependencies and opens PRs"
 engine:
   id: copilot
   model: claude-sonnet-4.5
-schedule: weekly on monday around 9:00
+on:
+  schedule: weekly on monday around 9:00
 pool: AZS-1ES-L-MMS-ubuntu-22.04
 tools:
   azure-devops: true

docs/front-matter.md

@@ -16,13 +16,14 @@ engine: copilot # Engine identifier. Defaults to copilot. Currently only 'copilo
 #   id: copilot
 #   model: claude-opus-4.7
 #   timeout-minutes: 30
-schedule: daily around 14:00 # Fuzzy schedule syntax - see docs/schedule-syntax.md
-# schedule:                       # Alternative object format (with branch filtering)
-#   run: daily around 14:00
-#   branches:
-#     - main
-#     - release/*
-workspace: repo # Optional: "root", "repo" (alias: "self"), or a checked-out repository alias. If not specified, defaults to "root" when no additional repositories are listed in `checkout:`, and to "repo" when one or more additional repos are checked out. See "Workspace Defaults" below.
+on:
+  schedule: daily around 14:00 # Fuzzy schedule syntax - see docs/schedule-syntax.md
+  # schedule:                     # Alternative object format (with branch filtering)
+  #   run: daily around 14:00
+  #   branches:
+  #     - main
+  #     - release/*
+workspace: repo# Optional: "root", "repo" (alias: "self"), or a checked-out repository alias. If not specified, defaults to "root" when no additional repositories are listed in `checkout:`, and to "repo" when one or more additional repos are checked out. See "Workspace Defaults" below.
 pool: AZS-1ES-L-MMS-ubuntu-22.04 # Agent pool name (string format). Defaults to AZS-1ES-L-MMS-ubuntu-22.04.
 # pool:                        # Alternative object format (required for 1ES if specifying os)
 #   name: AZS-1ES-L-MMS-ubuntu-22.04

examples/azure-devops-mcp.md

@@ -1,7 +1,8 @@
 ---
 name: "ADO Work Item Triage"
 description: "Triages work items using the Azure DevOps MCP"
-schedule: daily around 9:00
+on:
+  schedule: daily around 9:00
 tools:
   azure-devops:
     toolsets: [core, work, work-items]

examples/lean-verifier.md

@@ -1,7 +1,8 @@
 ---
 name: "Lean Formal Verifier"
 description: "Analyzes code and builds formal Lean 4 proofs of critical invariants"
-schedule: weekly on friday around 17:00
+on:
+  schedule: weekly on friday around 17:00
 tools:
   cache-memory: true
 runtimes:

examples/sample-agent.md

@@ -1,7 +1,8 @@
 ---
 name: "Daily Code Review"
 description: "Reviews code changes and creates summary reports"
-schedule: daily
+on:
+  schedule: daily
 repositories:
   - repository: azure-devops-agentic-pipelines
     type: git