docs: fix legacy repositories:/checkout: references in prompts (#512)

Author: github-actions[bot]

prompts/debug-ado-agentic-workflow.md

@@ -347,7 +347,7 @@ This job executes the approved safe outputs using the write token. Failures here
 |-------|-------|-----|
 | Patch doesn't apply | Merge conflicts — target branch diverged since the agent ran | Rerun the pipeline; consider more frequent schedules |
 | Target branch not found | Branch name doesn't exist in the repository | Check `safe-outputs.create-pull-request.target-branch` |
-| Repository not in allowed list | Agent tried to create PR in a repo not in `checkout:` | Add the repository to both `repositories:` and `checkout:` |
+| Repository not in allowed list | Agent tried to create PR in a repo not in `repos:` | Add the repository to `repos:` (with `checkout: true`, which is the default) |
 | Patch too large | Patch file exceeds 5 MB limit | Reduce the scope of changes in agent instructions |
 | Path validation failed | Patch contains `..`, `.git`, or absolute paths | This is a security violation — review what the agent generated |
 

prompts/update-ado-agentic-workflow.md

@@ -39,7 +39,7 @@ When adding new fields, place them in the conventional front matter order:
 
 ```
 name → description → target → engine → schedule → workspace → pool →
-repositories → checkout → tools → mcp-servers → safe-outputs →
+repos → tools → mcp-servers → safe-outputs →
 triggers → steps → post-steps → setup → teardown → network →
 permissions → parameters
 ```
@@ -244,9 +244,9 @@ Before finalizing any update, verify:
 
 3. **Schedule syntax**: The schedule expression uses valid fuzzy schedule syntax. Valid frequencies: `daily`, `weekly on <day>`, `hourly`, `every Nh`, `every N minutes`, `bi-weekly`, `tri-weekly`. Valid time specs: `around HH:MM`, `between HH:MM and HH:MM`.
 
-4. **Repository aliases**: Every alias in `checkout:` exists in `repositories:`.
+4. **Repository aliases**: Every repo alias used in agent instructions or safe-output `repository:` fields exists as an entry in `repos:` with `checkout: true` (the default).
 
-5. **Workspace consistency**: If `workspace: repo` is set, ensure `checkout:` has additional repositories. If only `self` is checked out, `workspace: repo` is unnecessary (the compiler warns about this).
+5. **Workspace consistency**: If `workspace: repo` is set, ensure `repos:` has at least one additional repository with `checkout: true`. If only `self` is checked out, `workspace: repo` is unnecessary (the compiler warns about this).
 
 6. **Network domains**: If new MCPs or external services are added, ensure required domains are in `network.allowed`.