Pre-flight noops should produce zero AIC accounting #70252

Description

This is a spinoff from cli/cli#14749

A workflow step can write a noop safe output before the engine harness starts. The harness correctly exits without invoking the model, but the generated agent job completes successfully with an empty agent/token_usage.jsonl.

The daily AIC guardrail treats that successful job as missing accounting and applies the configured max-ai-credits fallback.

We observed five consecutive no-work runs in cli/cli being counted as 1000 AIC each, despite having zero model invocations.

$ gh run view 39141727797 --repo cli/cli --log | grep -E 'Computed run AIC.*(39137237820|39132745345|39128819878|39124342426|39120364428)|Completed AIC inspection window' | sed -E 's/^activation[[:space:]]+UNKNOWN STEP[[:space:]]+//'

[daily-workflow-aic] Computed run AIC: {"runId":39137237820,"aic":1000,"reason":"max_ai_credits_fallback"}
[daily-workflow-aic] Computed run AIC: {"runId":39132745345,"aic":1000,"reason":"scan_cache"}
[daily-workflow-aic] Computed run AIC: {"runId":39128819878,"aic":1000,"reason":"scan_cache"}
[daily-workflow-aic] Computed run AIC: {"runId":39124342426,"aic":1000,"reason":"scan_cache"}
[daily-workflow-aic] Computed run AIC: {"runId":39120364428,"aic":1000,"reason":"scan_cache"}
[daily-workflow-aic] Completed AIC inspection window: {"currentAIC":5000,"threshold":5000,"exceeded":true}

The final run had an empty worklist and zero invocations.

$ tmp=$(mktemp -d); gh aw audit 39137237820 --repo cli/cli --artifacts usage,agent -o "$tmp" >/dev/null; run_dir=$(find "$tmp" -type f -name audit.json -exec dirname {} \; | head -1); grep -E 'PR #[0-9]+: (already assessed|needs assessment)|Work list:' "$run_dir/workflow-logs/3_agent.txt" | sed -E 's/^.*Z //' | tail -2; jq '{working_set:.working_set}' "$run_dir/usage/activity/summary.json"; rm -rf "$tmp"

PR #14716: already assessed at 35c2bf381bb42655fb40ec8ebf2e0a0548ef7543, skipping
Work list: 0 PR(s) -> /tmp/gh-aw/dependabot-worklist.json
{
  "working_set": {
    "cumulative_input_tokens": 0,
    "peak_input_tokens": 0,
    "invocations": 0
  }
}

The harness intentionally exits before provider setup when a noop exists here. However, successful jobs with empty accounting are explicitly rejected here.

I think a trusted pre-flight noop should produce authoritative zero-use evidence before the harness exits. Missing accounting must continue to fail closed once model execution has actually started.