Fix runtime triage issue payload construction

[MackinnonBuck]

Summary

Allow jq in the SDK Runtime Triage workflow's narrow shell allowlist and regenerate the compiled workflow.

Why this is necessary

The workflow's generated safe-output instructions recommend jq -Rs to encode a completed multi-line Markdown body as a valid JSON create_issue payload. In the failed run, the agent had already prepared the real runtime issue body, but every jq invocation was denied because jq was absent from the workflow allowlist.

The missing tool did not directly consume the quota. After the documented payload-construction path was blocked, the agent incorrectly fell back to a live create_issue syntax probe using placeholder content. That placeholder passed validation and consumed the workflow's sole create_issue allowance, so the real researched issue could not be submitted.

Permitting only jq:* removes the concrete trigger for that fallback while preserving the existing one-issue quota, write-once warnings, and narrow command policy.

Validation

• Compiled cross-repo-issue-analysis twice with pinned gh-aw v0.88.2 in strict mode; the second compile produced no changes
• Confirmed the generated workflow adds only shell(jq:*)
• Built and validated a no-write mock JSON payload from the failed run's saved 5.2 KB Markdown issue body
• Ran git diff --check

Fixes #2666

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved blocking issues were identified.

Review tier: Lite (auto)
Findings: None

Note

Copilot is running an experiment and ran this review at Lite.

What changed in this PR

Updates the SDK Runtime Triage workflow to allow safe JSON issue-payload construction with jq and regenerates the compiled workflow.

Changes:

• Adds jq:* to the shell allowlist.
• Regenerates the compiled workflow metadata.

File	Description
.github/​workflows/​cross-repo-issue-analysis.md	Adds the jq shell permission.
.github/​workflows/​cross-repo-issue-analysis.lock.yml	Reflects the regenerated compiled workflow.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.