fix(workflows): let docs auditors open PRs for README and AGENTS.md

[jamesadevine]

Problem

The doc-freshness-check (docs rewriter) and bash-lint-auditor workflows are designed to edit AGENTS.md and README.md, but every run that touched those files filed an issue instead of opening a PR — producing a steady stream of docs: fix documentation drift issues (#1180, #1177, #1175, #1143, #1129, #1126, #1123, #1121, #1114, #1106, ...).

Root cause

gh-aw maintains a default protected-files set that includes README.md, AGENTS.md, CHANGELOG.md, CONTRIBUTING.md, etc. protected-files and allowed-files are orthogonal checks — listing a file in allowed-files does not remove it from the protected set. So any patch touching README/AGENTS.md hit the fallback-to-issue policy.

Fix

Switch protected-files from the string form to the object form with an exclude list in the two workflows that intentionally maintain these docs:

• doc-freshness-check — excludes AGENTS.md and README.md
• bash-lint-auditor — excludes AGENTS.md

The fallback-to-issue policy is fully preserved for all genuinely protected files (package manifests, CODEOWNERS, CHANGELOG.md, dot-folders, etc.) — the issue fallback safety net is intact; it just no longer trips on the docs these workflows are explicitly designed to update.

Validation

• Recompiled both .lock.yml files with gh aw compile (0 errors).
• Confirmed the compiled protected_files array now omits AGENTS.md/README.md while protected_files_policy stays fallback-to-issue.