workshop docs: add gh-aw doc links (round 8) (#1954)

- side-quest-13-04: link AIC to cost-management reference, gh aw audit to audit reference, add Cost Management link near guardrails
- side-quest-16-01: link Frontmatter to frontmatter reference
- side-quest-16-02: link frontmatter to frontmatter reference
- side-quest-16-05: link permissions to permissions reference

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: github-actions[bot]

workshop/side-quest-13-04-token-optimization.md

@@ -8,7 +8,7 @@
 
 - You completed [Build Your First Event-Driven Workflow: PR Auto-Reviewer](14b-pr-reviewer-workflow.md).
 - You have a working PR reviewer workflow or another workflow with at least 5 completed runs so you can compare before-and-after usage.
-- If you want extra background on AIC, audit artifacts, or budget guardrails, continue later to [Audit and Monitor Your Agentic Workflows](25-audit-and-observability.md) and [Manage Costs and AI Credit Budgets](26-manage-costs-and-budgets.md).
+- If you want extra background on [AIC](https://github.github.com/gh-aw/reference/cost-management/#ai-credits-aic), audit artifacts, or budget guardrails, continue later to [Audit and Monitor Your Agentic Workflows](25-audit-and-observability.md) and [Manage Costs and AI Credit Budgets](26-manage-costs-and-budgets.md).
 
 ## Build a cost baseline
 
@@ -32,6 +32,8 @@ If one run is much higher than the others, audit it:
 gh aw audit <run-id> --parse
 ```
 
+> See the [gh aw audit reference](https://github.github.com/gh-aw/reference/audit/#gh-aw-audit) for full options.
+
 Then inspect:
 
 - `log.md` for long agent turns or repeated reasoning
@@ -111,6 +113,8 @@ After you reduce cost, keep it reduced:
 - Use `timeout-minutes` to stop unusually long runs.
 - Use [gh aw forecast](side-quest-26-01-forecast-costs.md) to size the guardrails from real history instead of guessing.
 
+> See [Cost Management](https://github.github.com/gh-aw/reference/cost-management/) for the full list of monitoring commands and guardrail options.
+
 ## Try it yourself
 
 ### Run one optimization cycle

workshop/side-quest-16-01-github-output.md

@@ -79,7 +79,7 @@ You can use any unique string as the delimiter — `EOF` is just a convention.
 
 Once your data is in `$GITHUB_OUTPUT`, you reference it directly inside the workflow Markdown body — which **is** the AI prompt in gh-aw. There is no separate step to invoke the AI; the body text is sent to the model after all step outputs have been resolved.
 
-**Frontmatter** (data-preparation step):
+**[Frontmatter](https://github.github.com/gh-aw/reference/frontmatter/)** (data-preparation step):
 
 ```yaml
 steps:

workshop/side-quest-16-02-secrets-and-permissions.md

@@ -116,7 +116,7 @@ The `gh` CLI reads `GH_TOKEN` automatically when it is set as an environment var
 <details>
 <summary>Learn how permissions frontmatter controls the built-in `GITHUB_TOKEN`</summary>
 
-gh-aw workflows declare required [permissions](https://github.github.com/gh-aw/reference/permissions/) in frontmatter. Only request what you need:
+gh-aw workflows declare required [permissions](https://github.github.com/gh-aw/reference/permissions/) in [frontmatter](https://github.github.com/gh-aw/reference/frontmatter/). Only request what you need:
 
 ```yaml
 ---

workshop/side-quest-16-05-long-lived-credentials.md

@@ -62,7 +62,7 @@ For any operation that touches only the current repository, use `${{ secrets.GIT
 
 ### Keep `permissions:` minimal
 
-Even an ephemeral `GITHUB_TOKEN` carries risk if it is over-scoped. Declare only the permissions your task actually needs. Compare the two blocks below:
+Even an ephemeral `GITHUB_TOKEN` carries risk if it is over-scoped. Declare only the [permissions](https://github.github.com/gh-aw/reference/permissions/) your task actually needs. Compare the two blocks below:
 
 ```yaml
 # ❌ Risky: broad write scopes for a read-only task