Allow Daily Safe Output Integrator to create its temp coverage script

.github/workflows/daily-safe-output-integrator.md

@@ -48,6 +48,7 @@ tools:
   - git status
   - git diff --name-only
   - cd * && git diff --name-only
+  - cat > /tmp/gh-aw/agent/*.py
   - python3 *
   cli-proxy: true
   edit: null
@@ -86,6 +87,8 @@ Ensure every supported safe-output type has both:
 - Use one compact script (saved under `/tmp/gh-aw/agent/`) to emit:
   - covered types (with file examples),
   - missing types requiring new fixtures.
+- Create that temporary script with the edit tool or the allowed `cat > /tmp/gh-aw/agent/*.py` bash command, then run it with `python3`.
+- Do not retry alternate shell-redirection paths; use only the allowed `/tmp/gh-aw/agent/` path.
 - Do not rely on repeated hardcoded frontmatter examples; generate fixtures from a single template pattern.
 
 ### Phase 3: Detect Go compiler-test gaps

pkg/workflow/daily_safe_output_integrator_workflow_test.go

@@ -0,0 +1,54 @@
+//go:build !integration
+
+package workflow
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestDailySafeOutputIntegratorIncludesTempCoverageScriptAllowlist(t *testing.T) {
+	sourceContent, err := os.ReadFile("../../.github/workflows/daily-safe-output-integrator.md")
+	if err != nil {
+		t.Fatalf("failed to read workflow source: %v", err)
+	}
+
+	sourceContentStr := string(sourceContent)
+	bashSectionStart := strings.Index(sourceContentStr, "  bash:\n")
+	if bashSectionStart == -1 {
+		t.Fatal("expected workflow source to contain a bash tool allowlist")
+	}
+	bashSectionEnd := strings.Index(sourceContentStr[bashSectionStart:], "  cli-proxy: true")
+	if bashSectionEnd == -1 {
+		t.Fatal("expected workflow source bash tool allowlist to end before cli-proxy")
+	}
+	bashSection := sourceContentStr[bashSectionStart : bashSectionStart+bashSectionEnd]
+	if !strings.Contains(bashSection, "  - cat > /tmp/gh-aw/agent/*.py") {
+		t.Fatal("expected bash allowlist to include temporary coverage script creation")
+	}
+
+	for _, expected := range []string{
+		"- Create that temporary script with the edit tool or the allowed `cat > /tmp/gh-aw/agent/*.py` bash command, then run it with `python3`.",
+		"- Do not retry alternate shell-redirection paths; use only the allowed `/tmp/gh-aw/agent/` path.",
+	} {
+		if !strings.Contains(sourceContentStr, expected) {
+			t.Fatalf("expected workflow source guidance to contain %q", expected)
+		}
+	}
+
+	lockContent, err := os.ReadFile("../../.github/workflows/daily-safe-output-integrator.lock.yml")
+	if err != nil {
+		t.Fatalf("failed to read compiled workflow: %v", err)
+	}
+
+	lockContentStr := string(lockContent)
+	for _, expected := range []string{
+		"shell(cat > /tmp/gh-aw/agent/*.py)",
+		"{{#runtime-import .github/workflows/daily-safe-output-integrator.md}}",
+	} {
+		if !strings.Contains(lockContentStr, expected) {
+			t.Fatalf("expected compiled workflow to contain %q", expected)
+		}
+	}
+}