Add do-not-edit notice as first line of lock.yml files

[Copilot]

Lock files generated by gh aw compile had no machine-readable signal at the top to deter agents from editing them directly.

Changes

• pkg/workflow/compiler_yaml.go: emits the following as the absolute first line of every lock.yml, before # gh-aw-metadata:

  # This file was auto-generated by "gh aw compile" from https://github.com/github/gh-aw. Do not edit directly.
  

• pkg/workflow/redact_secrets_test.go: updates ordering assertions — new notice is lines[0], # gh-aw-metadata shifts to lines[1]
• 245 .lock.yml files regenerated via make recompile

[pelikhan]

Update sentence to include https://github.com/github/gh-aw

[pelikhan]

@copilot update sentence to include https://github.com/github/gh-aw

[Copilot]

Pull request overview

This PR adds an explicit “do not edit” sentinel line to the top of generated workflow lock files so automated agents (and humans) have a clear, stable signal that .lock.yml is compiler output and should not be hand-edited.

Changes:

• Emit # This file was auto-generated by "gh aw compile". Do not edit directly. as the first line of generated lock files.
• Update the lock-header ordering test to account for the new first-line notice.
• Regenerate existing .lock.yml workflows to include the notice.

Show a summary per file

File	Description
pkg/workflow/compiler_yaml.go	Writes the new do-not-edit notice before the existing # gh-aw-metadata header emission.
pkg/workflow/redact_secrets_test.go	Adjusts assertions to ensure the notice is line 0 and # gh-aw-metadata is line 1, plus ordering checks.
.github/workflows/*.lock.yml	Regenerated lock files to include the new notice as the first line.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 247/247 changed files
• Comments generated: 0

[pelikhan]

@copilot this line is unnecessary because it was moved to the first line of the file.

[Copilot]

@copilot update sentence to include https://github.com/github/gh-aw

Updated in b8b0553. The generated first-line notice now includes https://github.com/github/gh-aw, and lock files were recompiled with the new sentence.