Scope Course Updater edits to course content and fall back to an issue on protected files

[Copilot]

The weekly Course Updater run failed because the agent's patch touched .github/agents/pytest-helper.agent.md and .github/agents/python-reviewer.agent.md. gh-aw protects the .github/ path prefix, and with no protected-files policy set the default is a hard block, so create_pull_request was refused and the run failed.

Two root issues: the prompt never told the agent which files are in scope, and there was no graceful degradation when it strayed.

.github/workflows/course-updater.md

• Step 4 now scopes edits explicitly — chapter README.md files (00–07), root README.md, GLOSSARY.md, appendices/, samples/. Editing .github/, .agents/, or package manifests is called out as forbidden, with instructions to describe such a change in the PR body instead.
• Frontmatter sets protected-files: fallback-to-issue on the create-pull-request safe output, so a future protected-file edit opens a review issue rather than failing the run. The safe_outputs job already has issues: write.

  create-pull-request:
    labels: [automated-update, copilot-cli-updates]
    title-prefix: "[bot] "
    base-branch: main
    protected-files: fallback-to-issue

.github/workflows/course-updater.lock.yml

Regenerated by hand — the gh aw extension can't be installed in the sandbox (API 403). Three lines:

• "protected_files_policy":"fallback-to-issue" added to both create_pull_request handler config blobs, in alphabetical key order matching what gh-aw v0.68.1 emits for traffic-updater.
• frontmatter_hash in the gh-aw-metadata header updated. The workflow's "Check workflow lock file" step fails the run on a mismatch; the new hash was produced with gh-aw's own frontmatter_hash_pure.cjs, after confirming it reproduced the prior hash for the unmodified source. Worth re-running gh aw compile on review to confirm byte-for-byte equivalence.

The prompt body is runtime-imported rather than embedded in the lock, so the Step 4 wording required no lock change.

Note on the alternative

allowed-files was considered and rejected: in checkFileProtection an allowlist miss is a hard deny with no fallback path, which would reintroduce the same failure mode instead of degrading to an issue.

• Fixes [aw] Course Updater failed #228