fix(workflows): exempt catalog automation from PR-count confirmation (#4607)

Clarify that repository-owned community extension, preset, and bundle
workflows bypass the ordinary contributor confirmation gate only after
successful validation and allowed catalog/docs updates.

Add regression coverage for the runtime-imported instruction, draft PR
configuration, and catalog-specific allowed files.

Fixes #4597

Co-authored-by: WOLIKIMCHENG <WOLIKIMCHENG@users.noreply.github.com>

Author: WOLIKIMCHENG

.github/workflows/add-community-bundle.md

@@ -276,6 +276,11 @@ repository README remains the source for the actual URLs.
 
 Create one draft pull request.
 
+This repository-owned gh-aw maintenance workflow does not perform the contributor
+open-PR count check or request confirmation. After successful validation and
+allowed catalog/docs file updates, emit the configured draft `create_pull_request`
+safe output regardless of the submitter's or filing account's open PR count.
+
 - New entry branch:
   `community/${{ github.event.issue.number }}-add-<bundle-id>-bundle`
 - Update branch:

.github/workflows/add-community-extension.md

@@ -257,6 +257,11 @@ Find the existing row and update any changed fields in-place.
 
 Create a pull request with the changes. Use this branch naming convention:
 
+This repository-owned gh-aw maintenance workflow does not perform the contributor
+open-PR count check or request confirmation. After successful validation and
+allowed catalog/docs file updates, emit the configured draft `create_pull_request`
+safe output regardless of the submitter's or filing account's open PR count.
+
 - **New extension:** `add-<extension-id>-extension`
 - **Update:** `update-<extension-id>-extension`
 

.github/workflows/add-community-preset.md

@@ -310,6 +310,11 @@ Find the existing row and update any changed fields in-place.
 
 Create a pull request with the changes. Use this branch naming convention:
 
+This repository-owned gh-aw maintenance workflow does not perform the contributor
+open-PR count check or request confirmation. After successful validation and
+allowed catalog/docs file updates, emit the configured draft `create_pull_request`
+safe output regardless of the submitter's or filing account's open PR count.
+
 - **New preset:** `add-<preset-id>-preset`
 - **Update:** `update-<preset-id>-preset`
 

tests/test_github_workflows.py

@@ -56,6 +56,12 @@
         "Do not modify any other files",
     ),
 )
+REPOSITORY_OWNED_DRAFT_PR_EXEMPTION = (
+    "This repository-owned gh-aw maintenance workflow does not perform the contributor "
+    "open-PR count check or request confirmation. After successful validation and "
+    "allowed catalog/docs file updates, emit the configured draft `create_pull_request` "
+    "safe output regardless of the submitter's or filing account's open PR count."
+)
 
 
 def _publish_workflow_steps() -> dict[str, dict[str, object]]:
@@ -440,8 +446,15 @@ def test_community_upgrade_preserves_activation_and_permission_guards(kind):
 def test_community_upgrade_preserves_scoped_draft_pr_contract(
     kind, label, catalog_file, docs_file, instruction
 ):
-    source_text, _, source, compiled = _agentic_workflow(f"add-community-{kind}")
+    source_text, compiled_text, source, compiled = _agentic_workflow(
+        f"add-community-{kind}"
+    )
     assert instruction in source_text
+    assert REPOSITORY_OWNED_DRAFT_PR_EXEMPTION in " ".join(source_text.split())
+    assert (
+        f"{{{{#runtime-import .github/workflows/add-community-{kind}.md}}}}"
+        in compiled_text
+    )
     outputs = _safe_output_config(compiled)
     expected_outputs = {
         "add_comment", "add_labels", "create_pull_request", "noop",