docs: Remove write permissions from all examples, use safe-outputs pattern

[Copilot]

Removed all direct write permissions from documentation examples per feedback that write permissions are not recommended in agentic workflows. All examples now follow the recommended pattern: read-only permissions with write operations handled through safe-outputs.

Changes

Top-level example - Replaced issues: write / pull-requests: write with actions: read + safe-outputs:

permissions:
  contents: read
  actions: read
safe-outputs:
  create-issue:
  add-comment:

Security-First Design - Changed principle from "Explicit permissions" to "No direct write permissions"

Configuration examples - All configuration examples now demonstrate safe-outputs pattern instead of direct write permissions

Shorthand options - Moved write-all from bullet list to caution callout explicitly warning against write permissions

Common Patterns - Removed write permissions from all four workflow patterns:

• IssueOps: contents: read + actions: read with add-comment safe output
• PR Review: contents: read + actions: read with create-pr-review-comment safe output
• Scheduled: contents: read + actions: read with create-issue safe output
• Manual: read-all with approval gate (unchanged)

Validation errors - Updated to reference "direct write permissions in the main job" instead of generic "write permissions without safe outputs"

Screenshots

Updated permissions page showing recommended pattern:

Common patterns with read-only + safe-outputs approach:

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• telemetry.astro.build
  • Triggering command: node /home/REDACTED/work/gh-aw/gh-aw/docs/node_modules/.bin/astro dev (dns block)
  • Triggering command: node /home/REDACTED/work/gh-aw/gh-aw/docs/node_modules/.bin/astro build (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)