feat: add bug-assess agentic workflow (#3023)

* feat: add bug-assess agentic workflow

Add a gh-aw agentic workflow that triggers when an issue is labeled
`bug-assess`. It assesses the report against the codebase (symptom, suspected
code paths, verdict, severity, remediation) and posts the full assessment.md as
an issue comment, led by a one-line valid?/priority summary. It also applies
severity / needs-reproduction / invalid triage labels.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: disable noop report-as-issue for bug-assess workflow

Set safe-outputs.noop.report-as-issue: false so noop runs on
failures/timeouts no longer create extra report issues, keeping
outputs limited to the issue comment and triage labels.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: clarify bug-assess label filtering is job-level

Reword the Triggering Conditions paragraph to reflect that the
issues:labeled trigger fires for any label and the bug-assess
filtering happens via a job-level condition, not at the trigger.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: tighten bug-assess prompt guardrails

- Add a 65,000-char comment-size limit instruction with explicit
  truncation marking so large reports don't fail the safe-outputs
  validator.
- Clarify the read-only guardrail: scratch files allowed under
  $RUNNER_TEMP, never write into the working tree or commit/push.
- Align the one-line summary verdict vocabulary (Invalid) with the
  canonical 'invalid' verdict and Step 8 label rules.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: align bug-assess severity wording and recompile with v0.78.1

- Use 'severity' instead of 'priority' in the Step 7 one-line summary to
  match Step 5, the Severity header field, and the severity-* labels.
- Clarify the read-only guardrail: comment + labels are the intended
  outputs on success, while the gh-aw harness may separately emit
  failure-report artifacts/issues when a run errors or times out.
- Recompile with gh-aw v0.78.1 so the gh-aw-actions/setup pin matches
  the repo's other workflow lock files and actions-lock.json.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Manfred Riem <mnriem@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: mnriem

.github/aw/actions-lock.json

@@ -5,10 +5,10 @@
       "version": "v9.0.0",
       "sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
     },
-    "github/gh-aw-actions/setup@v0.74.8": {
+    "github/gh-aw-actions/setup@v0.78.1": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.74.8",
-      "sha": "efa55847f72aadb03490d955263ff911bf758700"
+      "version": "v0.78.1",
+      "sha": "73ed520ae4ecd087a485e1991605595978b32ac1"
     }
   }
 }