feat: add close-issue, remove-labels, close-discussion, close-pull-request tests

New safe output coverage tests (copilot-only):
- test-copilot-close-issue: close triggering issue
- test-copilot-remove-labels: remove label from issue
- test-copilot-close-discussion: close triggering discussion
- test-copilot-close-pull-request: close triggering PR

Also adds tracking checklist to README.

Author: dsyme

.github/workflows/test-copilot-close-discussion.lock.yml

@@ -0,0 +1,18 @@
+---
+on:
+  discussion:
+    types: [created]
+  reaction: eyes
+
+permissions: read-all
+
+engine: 
+  id: copilot
+
+safe-outputs:
+  close-discussion:
+    target: "triggering"
+    # min: 1
+---
+
+If the title of the discussion #${{ github.event.discussion.number }} is exactly "Test close discussion from Copilot" then close the discussion with a comment "Closed by Copilot safe output" and resolution reason "RESOLVED".

.github/workflows/test-copilot-close-discussion.md

@@ -0,0 +1,18 @@
+---
+on:
+  issues:
+    types: [opened, reopened]
+  reaction: eyes
+
+permissions: read-all
+
+engine: 
+  id: copilot
+
+safe-outputs:
+  close-issue:
+    target: "triggering"
+    # min: 1
+---
+
+If the title of the issue #${{ github.event.issue.number }} is exactly "Test close issue from Copilot" then close the issue with a comment "Closed by Copilot safe output".

.github/workflows/test-copilot-close-issue.lock.yml

@@ -0,0 +1,18 @@
+---
+on:
+  pull_request:
+    types: [opened, reopened]
+  reaction: eyes
+
+permissions: read-all
+
+engine: 
+  id: copilot
+
+safe-outputs:
+  close-pull-request:
+    target: "triggering"
+    # min: 1
+---
+
+If the title of the pull request #${{ github.event.pull_request.number }} starts with "Test PR for Copilot Close" then close the pull request with a comment "Closed by Copilot safe output".

.github/workflows/test-copilot-close-issue.md

@@ -0,0 +1,18 @@
+---
+on:
+  issues:
+    types: [opened, reopened]
+  reaction: eyes
+
+permissions: read-all
+
+engine: 
+  id: copilot
+
+safe-outputs:
+  remove-labels:
+    allowed: [copilot-remove-label-test]
+    # min: 1
+---
+
+If the title of the issue #${{ github.event.issue.number }} is "Test remove label from Copilot" then remove the label "copilot-remove-label-test" from the issue.

.github/workflows/test-copilot-close-pull-request.lock.yml

@@ -46,4 +46,66 @@ Nightly GitHub Actions run at 3:00 AM UTC. Manually trigger via Actions → "Nig
 
 **Authentication issues**: Run `gh auth login` and `gh auth status`
 **Missing gh-aw**: Script auto-builds it, or manually: `git clone https://github.com/github/gh-aw.git && cd gh-aw && make build`
-**Timeouts**: Check log file `e2e-test-*.log` for details
+**Timeouts**: Check log file `e2e-test-*.log` for details
+
+## Safe Output Test Coverage
+
+Tracking the full matrix of [safe outputs](https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/safe-outputs.md) and [PR safe outputs](https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/safe-outputs-pull-requests.md). New tests are copilot-only (claude/codex coverage already exists for the original set).
+
+### Already Tested
+
+- [x] `create-issue` — test-copilot-create-issue
+- [x] `create-discussion` — test-copilot-create-discussion
+- [x] `create-pull-request` — test-copilot-create-pull-request
+- [x] `create-pull-request` (max:2) — test-copilot-create-two-pull-requests
+- [x] `create-code-scanning-alert` — test-copilot-create-repository-code-scanning-alert
+- [x] `mcp` — test-copilot-mcp
+- [x] `custom safe output jobs` — test-copilot-custom-safe-outputs
+- [x] `gh-steps` — test-copilot-gh-steps
+- [x] `add-comment` — test-copilot-add-comment
+- [x] `add-comment` (discussions) — test-copilot-add-discussion-comment
+- [x] `add-labels` — test-copilot-add-labels
+- [x] `update-issue` — test-copilot-update-issue
+- [x] `update-pull-request` — test-copilot-update-pull-request
+- [x] `push-to-pull-request-branch` — test-copilot-push-to-pull-request-branch
+- [x] `create-pull-request-review-comment` — test-copilot-create-pull-request-review-comment
+- [x] `slash_command` + `add-comment` — test-copilot-command
+
+### Issues & Discussions — Remaining
+
+- [x] `close-issue` — test-copilot-close-issue
+- [ ] `link-sub-issue` — test-copilot-link-sub-issue
+- [ ] `update-discussion` — test-copilot-update-discussion
+- [x] `close-discussion` — test-copilot-close-discussion
+
+### Pull Requests — Remaining
+
+- [x] `close-pull-request` — test-copilot-close-pull-request
+- [ ] `reply-to-pull-request-review-comment` — test-copilot-reply-to-pull-request-review-comment
+- [ ] `resolve-pull-request-review-thread` — test-copilot-resolve-pull-request-review-thread
+- [ ] `submit-pull-request-review` — test-copilot-submit-pull-request-review
+- [ ] `add-reviewer` — test-copilot-add-reviewer
+
+### Labels, Assignments & Reviews — Remaining
+
+- [x] `remove-labels` — test-copilot-remove-labels
+- [ ] `hide-comment` — test-copilot-hide-comment
+- [ ] `assign-milestone` — test-copilot-assign-milestone
+- [ ] `assign-to-user` — test-copilot-assign-to-user
+- [ ] `unassign-from-user` — test-copilot-unassign-from-user
+
+### Security & Agent Tasks — Remaining
+
+- [ ] `dispatch-workflow` — test-copilot-dispatch-workflow
+- [ ] `call-workflow` — test-copilot-call-workflow
+
+### Deferred (require special infrastructure)
+
+- [ ] `assign-to-agent` — requires Copilot coding agent access
+- [ ] `create-agent-session` — requires Copilot coding agent access
+- [ ] `create-project` / `update-project` / `create-project-status-update` — requires PAT with Projects permissions
+- [ ] `update-release` — requires existing releases
+- [ ] `upload-asset` — requires orphaned branch setup
+- [ ] `autofix-code-scanning-alert` — requires existing code scanning alerts
+- [ ] `dispatch_repository` — experimental, requires cross-repo setup
+- [ ] `missing-data` — system type, auto-enabled