[WIP] Surface allowed-files scope to agent prompt for restricted workflows

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>[deep-report] Surface allowed-files scope to agent prompt for allowed-files-restricted workflows (e.g. design-decision-gate)</issue_title>
<issue_description>### Description
Workflows that restrict push_to_pull_request_branch with an allowed-files list (e.g. design-decision-gate, scoped to docs/adr/**) only discover an out-of-scope diff after the agent finishes and the safe-outputs handler rejects the push. Confirmed 2026-08-04: Design Decision Gate run §30867235474 built a bundle touching 4 unrelated source files plus the intended ADR doc, and the push was correctly blocked, wasting the full agent turn.

Expected Impact

Agents self-limit their diff to the allowed scope before generating output, reducing wasted agent turns/tokens on content that is guaranteed to be rejected downstream, and reducing confusing partial-failure batches in the safe_outputs job.

Suggested Agent

Workflow authors / prompt-generation maintainer for allowed-files-restricted workflows

Estimated Effort

Quick (< 1 hour) — inject the configured allowed-files patterns into the generated system/task prompt for any workflow using push_to_pull_request_branch with allowed-files set, so the constraint is visible to the agent at generation time rather than only enforced at the handler.

Data Source

DeepReport Intelligence Briefing 2026-08-04, Safe Output Health Monitor discussion (2026-08-04), Recommendation #3.

Generated by 🔬 Deep Report · agent · 197.5 AIC · ⌖ 40.2 AIC · ⊞ 11K · ◷

• expires on Aug 6, 2026, 7:39 AM UTC-08:00

• Closes [deep-report] Surface allowed-files scope to agent prompt for allowed-files-restricted workflows (e.g. design-decision-gate) #50302

Comments on the Issue (you are @copilot in this section)

• Fixes [deep-report] Surface allowed-files scope to agent prompt for allowed-files-restricted workflows (e.g. design-decision-gate) #50302