workshop docs: add gh-aw doc links to side-quest files (#1891)

Author: github-actions[bot]

workshop/side-quest-09-01f-debugging-checklist.md

@@ -25,7 +25,7 @@ You will apply a repeatable seven-step triage flow whenever a run produces unexp
 
 - [ ] I can run this checklist in order without skipping steps
 - [ ] I know where to find both live logs and safe-output records
-- [ ] I can decide whether the root cause is prompt, data, permissions, or output limits
+- [ ] I can decide whether the root cause is prompt, data, [permissions](https://github.github.com/gh-aw/reference/permissions/), or output limits
 - [ ] I can gather a minimal log snippet to share for deeper diagnosis
 
 <!-- /journey -->

workshop/side-quest-10-01-agent-brief.md

@@ -73,7 +73,7 @@ Quick check:
 <details>
 <summary>Why this works</summary>
 
-Inputs turn "summarize the repo" into a concrete data request. They also make it easier to spot missing permissions or tools when you build the workflow.
+Inputs turn "summarize the repo" into a concrete data request. They also make it easier to spot missing [permissions](https://github.github.com/gh-aw/reference/permissions/) or tools when you build the workflow.
 
 </details>
 

workshop/side-quest-10-02-jailbreak-brief.md

@@ -40,7 +40,7 @@ gh-aw uses five defence layers. Here is the short version, in three groups:
 
 - **Compiled task brief** — The task brief is baked in before any data arrives. Issue bodies and PR descriptions reach the agent as structured tool call results, competing with an authoritative baseline rather than replacing it.
 - **Minimal `permissions:` + `safe-outputs`** — The `GITHUB_TOKEN` enforces declared permission boundaries; `safe-outputs` removes write tool paths that were never declared, so a jailbreak instruction to push a commit has no execution path.
-- **`network.allowed-domains` + agentic threat detection** — The network layer blocks data exfiltration to unlisted endpoints; a separate detection job reviews agent output in an isolated sandbox before any write lands.
+- **`network.allowed-domains` + [agentic threat detection](https://github.github.com/gh-aw/reference/threat-detection/)** — The network layer blocks data exfiltration to unlisted endpoints; a separate detection job reviews agent output in an isolated sandbox before any write lands.
 
 <details>
 <summary>Detailed breakdown of each layer</summary>

workshop/side-quest-11-01b-workflow-structure.md

@@ -12,7 +12,7 @@
 
 An [agentic workflow](https://github.github.com/gh-aw/introduction/overview/) file has two parts:
 
-- **Frontmatter** — YAML between `---` fences at the top of the file. This configures how and when the workflow runs.
+- **[Frontmatter](https://github.github.com/gh-aw/reference/frontmatter/)** — YAML between `---` fences at the top of the file. This configures how and when the workflow runs.
 - **Markdown body** — the agent's task brief, written below the closing `---`. The AI reads this at runtime.
 
 The file ends in `.md` instead of `.yml` because the frontmatter is only the opening config block — the rest of the file is a Markdown brief that the agent reads at runtime. See the [Classic vs. Agentic comparison in Step 5](05-agentic-workflows-intro.md).

workshop/side-quest-11-02-yaml-frontmatter.md

@@ -4,7 +4,7 @@
 
 > _Optional: work through these common YAML mistakes if you hit a compile error in Step 11, then return to the main path._
 
-YAML is unforgiving. Here are the five errors learners hit most often when building agentic workflow frontmatter, each with a broken ❌ and correct ✅ example.
+YAML is unforgiving. Here are the five errors learners hit most often when building agentic workflow [frontmatter](https://github.github.com/gh-aw/reference/frontmatter/), each with a broken ❌ and correct ✅ example.
 
 ---
 

workshop/side-quest-11-03-better-prompts.md

@@ -2,7 +2,7 @@
 <!-- page-adventure: side-quest -->
 # Side Quest: Write Better AI Task Briefs
 
-> _Optional: work through this guide if you want to get more useful, consistent output from your agentic workflows — then return to [Step 11](07-your-first-workflow.md) or [Step 12](12-test-and-iterate.md)._
+> _Optional: work through this guide if you want to get more useful, consistent output from your [agentic workflows](https://github.github.com/gh-aw/introduction/overview/) — then return to [Step 11](07-your-first-workflow.md) or [Step 12](12-test-and-iterate.md)._
 
 ## 🎯 What You'll Do
 

workshop/side-quest-11-04-annotated-workflow.md

@@ -20,7 +20,7 @@ Understand the four design decisions that make `daily-status.md` safe and predic
 | Decision | What it controls |
 |---------|-----------------|
 | Narrow `permissions` | Only the scopes the workflow actually needs — limits blast radius |
-| `gh-proxy` in `tools` | Enforces permissions at the [network](https://github.github.com/gh-aw/reference/network/) level |
+| `gh-proxy` in `tools` | Enforces [permissions](https://github.github.com/gh-aw/reference/permissions/) at the [network](https://github.github.com/gh-aw/reference/network/) level |
 | `max: 1` in `safe-outputs` | Caps writes to exactly one comment per run |
 | Fixed output template | Same format every run — easy to scan and audit |
 

workshop/side-quest-11-05-event-triggers.md

@@ -2,7 +2,7 @@
 <!-- page-adventure: side-quest -->
 # Side Quest: Event-Driven Triggers in Agentic Workflows
 
-> _Optional: use this primer if you want help choosing between scheduled and event-driven workflows before you finish [Build — PR Code Reviewer](15-conditional-logic.md), then return to the main adventure._
+> _Optional: use this primer if you want help choosing between [scheduled](https://github.github.com/gh-aw/reference/triggers/#scheduled-triggers-schedule) and event-driven workflows before you finish [Build — PR Code Reviewer](15-conditional-logic.md), then return to the main adventure._
 
 ## 🎯 What You'll Do