feat(workflows): recompile tests/safe-outputs fixtures on each ado-aw release

[jamesadevine]

Summary

Adds a new gh-aw agentic workflow at .github/workflows/recompile-safe-output-fixtures.md that automatically recompiles every tests/safe-outputs/*.lock.yml fixture against the latest released ado-aw binary and opens one PR with the diff.

Motivation: each release bumps the embedded version field in the # ado-aw-metadata: { … } marker (and may change other compiled output) at the top of every fixture lock file. Without an automation, those bumps have to be propagated by hand after every release, and the daily smoke pipelines run against a stale compiler version in the meantime.

Behavior

• Trigger: workflow_run on the Release workflow (success on main only), plus workflow_dispatch with an optional version input for manual reruns or backfills.
• Pipeline:
  1. Bail out if workflow_run did not succeed on main.
  2. Resolve the target version (input override or gh release view), normalize to vX.Y.Z.
  3. Download ado-aw-linux-x64 + checksums.txt from the release with bounded retry (12 × 30s) to absorb asset-upload latency.
  4. Verify SHA256 strictly via awk column match (not loose grep); sanity-check ado-aw --version against the bare version.
  5. Run ado-aw compile tests/safe-outputs/ under strict shell mode.
  6. Detect changes with git status --porcelain -- tests/safe-outputs/; emit noop if nothing changed.
  7. Open one PR titled chore(workflows): recompile safe-output fixtures with ado-aw vX.Y.Z with a from→to version range extracted from a sample lock file's metadata marker.
• Idempotency: safe-outputs.close-pull-request with prefix chore(workflows): recompile safe-output fixtures auto-closes superseded recompile PRs from older releases. A second run for the same version short-circuits via noop.
• Scope discipline: safe-outputs.create-pull-request.allowed-files restricts diffs to tests/safe-outputs/**/*.lock.yml. The agent also aborts (report-incomplete) if compile output touches paths outside that directory.
• Failure modes are all explicit: missing-data for bad/missing version or version mismatch, report-incomplete for compile failure / assets never arriving / unexpected diff scope.

Files

• .github/workflows/recompile-safe-output-fixtures.md — workflow source
• .github/workflows/recompile-safe-output-fixtures.lock.yml — compiled output (gh-aw v0.77.5)

Other modified *.lock.yml files in the working tree are unrelated drift from running gh aw compile (no args) locally against gh-aw v0.77.5 and are intentionally not included in this PR; they belong in a separate sweep PR.

Test plan

• gh aw compile recompile-safe-output-fixtures — clean compile with zero warnings after addressing the three flagged by the first run:
  • rewrote temp paths under /tmp/gh-aw/agent/
  • added branches: [main] to the workflow_run trigger
  • added issues: read to satisfy the GitHub toolset requirement
• Front matter validated against the gh-aw v0.77.5 frontmatter reference (workflow_run is a standard GH Actions trigger; safe-outputs and network fields match conventions used by update-awf-version.md / clippy-fixer.md).
• Once merged, the first end-to-end exercise will come automatically with the next ado-aw release.