Stop agentic-workflow failure-issue spam (#19953)

The scheduled babysitter workflows (labelops-pr-maintenance, labelops-pr-
security-scan, regression-pr-shepherd) open `[aw] … failed` tracking issues on
every transient gh-aw infra crash (unhealthy firewall container) or engine
hiccup. Their real signal is the labels/comments they apply to PRs, so disable
report-failure-as-issue for them.

aw-auto-update emits `create-agent-session`, which needs a Copilot-licensed
token the default GITHUB_TOKEN lacks, so every scheduled detection that finds
an update fails the safe_outputs job and spams failure issues. Disable its
schedule (manual dispatch only) until a suitable token is provisioned.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: T-Gro

.github/workflows/aw-auto-update.lock.yml

@@ -12,7 +12,11 @@ description: |
   identity (COPILOT_GITHUB_TOKEN) and can write workflow files.
 
 on:
-  schedule: every 24h
+  # Schedule disabled: `create-agent-session` needs a Copilot-licensed token, which
+  # the default GITHUB_TOKEN lacks, so every scheduled detection that finds an update
+  # fails the safe_outputs job and spams `[aw] … failed` issues. Re-enable the
+  # `schedule:` trigger once a Copilot-licensed token (e.g. GH_AW_AGENT_TOKEN) is
+  # provisioned for create-agent-session. Until then it is manual-dispatch only.
   workflow_dispatch:
 
 timeout-minutes: 15

.github/workflows/aw-auto-update.md

@@ -36,6 +36,9 @@ tools:
   bash: true
 
 safe-outputs:
+  # Transient gh-aw infra crashes (e.g. unhealthy firewall container) and engine
+  # hiccups must not open tracking issues — real problems surface as PR labels/comments.
+  report-failure-as-issue: false
   noop:
     report-as-issue: false
   max-patch-size: 10240