fix: wire negative max-daily-effective-tokens validation and populate TokenUsage in audit test fixture

[Copilot]

Two tests introduced in recent commits failed on main because the implementation lagged behind the test assertions.

TestDailyETGuardrailNegativeValueRejected

validateMaxDailyEffectiveTokensFrontmatter was missing — the compiler accepted max-daily-effective-tokens: -1 without error. Added the validator and wired it into compiler_validators.go.

TestAgentFriendlyOutputExample/Console_Output

The steering= assertion (added alongside renderConsole's new tokens line) was unreachable because the test's ProcessedRun had no TokenUsage set, so data.FirewallTokenUsage was nil and the tokens line was never rendered. Fixed by populating TokenUsage in the test fixture:

processedRun := ProcessedRun{
    ...
    TokenUsage: &TokenUsageSummary{
        TotalInputTokens:    40000,
        TotalOutputTokens:   5000,
        TotalRequests:       42,
        TotalSteeringEvents: 3,
    },
    ...
}

[Copilot]

Pull request overview

This PR updates a large set of GitHub Actions workflow lock files to write a Copilot CLI settings file (/home/runner/.copilot/settings.json) during execution, disabling the built-in rubberDuck agent and cleaning up the file on step exit.

Changes:

• Add a trap + settings.json write to disable builtInAgents.rubberDuck in Copilot CLI run steps across many .lock.yml workflows.
• Ensure the Copilot settings file is cleaned up at the end of the step via trap ... EXIT.

Show a summary per file

File	Description
.github/workflows/daily-mcp-concurrency-analysis.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-malicious-code-scan.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-issues-report.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-hippo-learn.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-geo-optimizer.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-firewall-report.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-file-diet.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-experiment-report.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-compiler-quality.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-community-attribution.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-cli-tools-tester.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-cli-performance.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-byok-ollama-test.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-assign-issue-to-user.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-architecture-diagram.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-ambient-context-optimizer.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/craft.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/copilot-pr-prompt-analysis.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/copilot-pr-nlp-analysis.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/copilot-pr-merged-report.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/copilot-opt.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/copilot-cli-deep-research.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/contribution-check.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/constraint-solving-potd.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/code-simplifier.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/code-scanning-fixer.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/cli-consistency-checker.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/ci-coach.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/chaos-pr-bundle-fuzzer.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/breaking-change-checker.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/brave.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/bot-detection.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/auto-triage-issues.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/artifacts-summary.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/architecture-guardian.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/archie.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/agent-persona-explorer.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/agent-performance-analyzer.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/ace-editor.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.
.github/workflows/ab-testing-advisor.lock.yml	Disable Copilot built-in rubberDuck via settings.json during CLI execution.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 42/42 changed files
• Comments generated: 1