Fix daily-spdd-spec-planner tool denial limit exceeded

[Copilot]

The specs/forecast-compliance-fixtures/ subdirectory (added June 26) pushed the workflow over the 5/5 tool-denial guardrail. The previous successful run had 4 denials; the new subdirectory file added a 5th.

Denial breakdown from run 28251414746:

• 3× glob on workspace root — no path pattern covered the workspace root directory
• 1× view on specs/forecast-compliance-fixtures/README.md — cat specs/*.md only extracts specs/*.md as a readable pattern; subdirectory files don't match
• 1× shell(python3 ...) — agent tried to construct issue JSON via Python instead of calling create_issue MCP directly → hit threshold, session aborted

Changes:

• Bash allowlist — add cat specs/**/*.md alongside the existing cat specs/*.md. The SDK permission handler extracts specs/**/*.md as a readable path pattern, which glob-matches any file in any specs/ subdirectory.

• Prompt guidance — explicitly tell the agent to use the allowed find specs docs scratchpad -type f -name "*.md" bash command for file discovery instead of the glob tool on the workspace root, and to call the create_issue MCP tool directly rather than building JSON payloads via shell/python3.

• Test — add assertion that "cat specs/**/*.md" is present in the workflow to prevent regression when new spec subdirectories are added.

[Copilot]

Pull request overview

This PR addresses a regression where the daily-spdd-spec-planner workflow exceeded the Copilot SDK tool-denial threshold after adding spec fixtures under specs/ subdirectories, by expanding the bash allowlist and adding a regression test to ensure subdirectory spec reads remain permitted.

Changes:

• Extend the workflow’s bash allowlist to include cat specs/**/*.md so read-only inspection tools can access markdown specs in nested specs/ directories.
• Add explicit prompt guidance to prefer the allowed find specs docs scratchpad -type f -name "*.md" command for discovery (avoiding denied root-level glob usage).
• Add a test assertion to prevent the cat specs/**/*.md allowlist entry from being removed in future edits.

Show a summary per file

File	Description
pkg/workflow/prompts_test.go	Adds a regression assertion that the workflow includes cat specs/**/*.md in the bash allowlist.
.github/workflows/daily-spdd-spec-planner.md	Expands bash allowlist and adds prompt guidance to avoid denial-heavy discovery patterns.
.github/workflows/daily-spdd-spec-planner.lock.yml	Regenerated compiled lock file reflecting the updated allowlist entry.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Low