ci: upgrade gh-aw to v0.89.21 and fix staleness reporting 🤖🤖🤖

[aaronpowell]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Upgrade the repository's GitHub Agentic Workflows tooling from v0.88.8 to v0.89.21 and fix the Resource Staleness Report's missing Git history.

• Refresh the nine tracked workflow locks, action/container pins, maintenance workflow, Copilot setup CLI version, and AW skill reference list.
• Configure resource-staleness-report.md with checkout: fetch-depth: 0 so the agent can determine per-resource change dates without attempting a blocked in-sandbox fetch.
• Keep the corresponding compiled lock synchronized with the source.

Closes #4346.

The failure investigation also confirmed that the Learning Hub allowed-files path failures (#4340, #4476, #4612) and PR Quality authentication failure (#4483) were addressed separately by #3915 and #3722. This PR does not introduce those fixes or claim the AW upgrade resolves every detection warning in #3240.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

Validation

Command	Result
gh aw compile --strict --no-emit --no-check-update	Passed: all nine workflows compiled with zero warnings.
gh aw compile resource-staleness-report --strict --no-check-update	Passed: regenerated the staleness lock with zero warnings.
npm run build	Passed; README outputs unchanged. Existing external-plugin metadata warnings were reported.
bash eng/fix-line-endings.sh	Passed; no unrelated tracked changes introduced.
git diff --check	Passed.
git diff --cached --check	Passed before committing.

No hosted workflow runs were manually dispatched. Full-history checkout still needs confirmation in the next hosted staleness run; its previous run reported missing data despite a successful Actions conclusion.

The unchecked new-resource and paid-service checklist items are not applicable to this repository automation update. The npm start item is left unchecked because npm run build was run directly instead.

The compiled files included here are existing, version-controlled Actions deployment files under .github/workflows/, not new community workflow submissions under workflows/. No unrelated generated build output is included.

AI disclosure: the maintainer supplied the local AW upgrade; GitHub Copilot inspected failure issues and run evidence, assisted with the full-history fix, and prepared this commit and PR.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 2 approvals from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• .github/aw/actions-lock.json is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/skills/agentic-workflows/SKILL.md is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/workflows/advanced-copilot-cli-sync.lock.yml is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/workflows/agentics-maintenance.yml is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/workflows/cli-for-beginners-sync.lock.yml is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/workflows/codeowner-update.lock.yml is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/workflows/copilot-setup-steps.yml is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/workflows/copilot-workshops-sync.lock.yml is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/workflows/duplicate-resource-detector.lock.yml is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/workflows/learning-hub-updater.lock.yml is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/workflows/pr-duplicate-check.lock.yml is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/workflows/pr-quality-signal.lock.yml is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/workflows/resource-staleness-report.lock.yml is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/workflows/resource-staleness-report.md is a high-risk path (automation, scripts, MCP config, hooks, or review policy)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Submission gate tests	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	✅ Passed	Passed · logs

Review

• Approvals: 0/2
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 2 more approval(s); an approval from a maintainer with admin or maintain permission
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for 0f4be4d · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The broad generated Actions runtime upgrade and full-history behavior still require confirmation in hosted workflow runs.

Review effort: Balanced
Findings: None

What changed in this PR

Upgrades Agentic Workflows tooling and restores accurate resource-staleness reporting.

Changes:

• Regenerates nine workflow locks with gh-aw v0.89.21.
• Updates maintenance, setup, runtime pins, and workflow guidance.
• Enables full Git history for staleness analysis.

File	Description
.github/​aw/​actions-lock.json	Updates action and container pins.
.github/​skills/​agentic-workflows/​SKILL.md	Adds work-queue guidance reference.
.github/​workflows/​advanced-copilot-cli-sync.lock.yml	Regenerates workflow lock.
.github/​workflows/​agentics-maintenance.yml	Upgrades generated maintenance workflow.
.github/​workflows/​cli-for-beginners-sync.lock.yml	Regenerates workflow lock.
.github/​workflows/​codeowner-update.lock.yml	Regenerates workflow lock.
.github/​workflows/​copilot-setup-steps.yml	Updates installed gh-aw version.
.github/​workflows/​copilot-workshops-sync.lock.yml	Regenerates workflow lock.
.github/​workflows/​duplicate-resource-detector.lock.yml	Regenerates workflow lock.
.github/​workflows/​learning-hub-updater.lock.yml	Regenerates workflow lock.
.github/​workflows/​pr-duplicate-check.lock.yml	Regenerates workflow lock.
.github/​workflows/​pr-quality-signal.lock.yml	Regenerates workflow lock.
.github/​workflows/​resource-staleness-report.md	Requests full-history checkout.
.github/​workflows/​resource-staleness-report.lock.yml	Compiles the checkout fix and upgrade.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.