[instructions] Sync instruction files with release v0.89.17

[github-actions]

Summary

Audited .github/aw/*.md instruction files against changes since the latest release (v0.89.17, published 2026-09-19).

Release/change audit

Reviewed commits on docs/ and .github/aw/ since v0.89.17 (repo is a shallow clone, so this used the GitHub API rather than local git history). Notable commits inspected:

• Add github-token-for-extra-empty-commit: none to keep GH_AW_CI_TRIGGER_TOKEN out of compiled workflows #62416 — added github-token-for-extra-empty-commit: none as a new opt-out value for create-pull-request / push-to-pull-request-branch. Not documented in .github/aw/safe-outputs-content.md or .github/aw/safe-outputs-management.md — fixed in this PR.
• Enforce configured targets in safe-output handlers #62447 — extended target enforcement to more safe-output handlers. Already accurately described generically in safe-outputs.md:22 ("target: is enforced, not merely validated"); no doc change needed.
• Preserve imported report-failed-jobs safe-output settings #62485 — fixed report-failed-jobs being dropped on import; reuse.md already documents safe-outputs: as deep-merged, so no doc change needed (behavior now matches the existing description).
• Propagate max-turn-cache-misses into the threat-detection job #62489 — propagated max-turn-cache-misses into the threat-detection job; this is an internal wiring fix with no new user-facing field, so no doc change needed.
• [caveman] Optimize instruction verbosity — loop.md (2026-09-21) #62470 ([caveman]) — already de-duplicated the loop-architecture section in loop.md prior to this run; verified no leftover duplicate heading remains.
• Pin Copilot CLI default back to 1.0.83 to fix instant HTTP 400 regression in 1.0.85 #62421, Remove push_repo_memory concurrency group so fan-out memory writes are not dropped #62414 — version pin and concurrency-group fixes with no .md-documented behavior affected (no hardcoded CLI versions or concurrency-group claims found in instruction files).

Size audit

wc -l .github/aw/*.md — all files remain under their target limits (largest is syntax-agentic.md at 391/400 lines; the two edited files are 379/400 and 317/400 after edits).

Duplication / accuracy audit

No new duplication introduced or found beyond the already-resolved loop.md case. The only accuracy gap found was the missing none sentinel value, now fixed.

Changes

• .github/aw/safe-outputs-content.md: documented github-token-for-extra-empty-commit: none in the create-pull-request field comment and the CI Triggering callout.
• .github/aw/safe-outputs-management.md: documented the same for push-to-pull-request-branch.

Before/after line counts: both files unchanged in line count (4 lines edited in place, no lines added/removed).

Test plan

• Confirmed github-token-for-extra-empty-commit: none behavior against the merged implementation (pkg/workflow/compiler_safe_outputs_steps.go, create_pull_request.go, push_to_pull_request_branch.go) and its ADR (docs/adr/62416-add-explicit-opt-out-for-ci-trigger-token-emission.md).
• wc -l .github/aw/*.md confirms both edited files stay under the 400-line target.
• grep confirms no other .md file references the old two-option (PAT or app) description for this field.

🤖 Generated with [Claude Code]((claude.com/redacted)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🧹 Instructions Janitor · claude · sonnet50 · 131.6 AIC · ⌖ 33.6 AIC · ⊞ 7.4K · ◷

• expires on Sep 24, 2026, 12:46 AM UTC-08:00

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.89.20