Fix gh-aw workflow issues: label gates, duplicate title prefixes, security restrictions, and Docker image pinning

[Copilot]

Four categories of issues identified in the gh-aw workflow migration PR review.

Duplicate title prefixes

safe-outputs title-prefix values were redundant with the titles the agent was instructed to construct, resulting in doubled prefixes (e.g., "Weekly Farm Check - Weekly Farm Check - Week N"). Removed title-prefix from weekly-reminder.md, eov-seasonal-reminder.md, and flock-action.md, with matching updates to GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG in the compiled lock files.

Missing label gates

flock-action.lock.yml and eov-enrichment.lock.yml triggered on every opened issue with no label filtering, despite the compiler comments claiming otherwise. Added if: conditions to the pre_activation job in each:

# flock-action.lock.yml
pre_activation:
  if: contains(github.event.issue.labels.*.name, 'flock-action')

# eov-enrichment.lock.yml
pre_activation:
  if: |
    contains(github.event.issue.labels.*.name, 'record:eov-site-assessment') ||
    contains(github.event.issue.labels.*.name, 'record:eov-soil-sample') ||
    ...

--allow-all-tools in weekly-reminder

weekly-reminder.lock.yml was compiled with --allow-all-tools --allow-all-paths, unlike the other workflows which use explicit allowlists. Replaced with --allow-path /tmp/gh-aw/ --allow-path "${GITHUB_WORKSPACE}".

Mutable Docker image reference

ghcr.io/zircote/nsip was referenced by tag only (supply chain risk). Pinned to digest in both flock-action.md and flock-action.lock.yml:

ghcr.io/zircote/nsip@sha256:a1480316dc0e122fdce2724fd0f255033d04c0830bcb4686605ea429d5b9e793

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR fixes four critical issues in the gh-aw workflow migration: duplicate title prefixes, missing label gates, overly permissive security settings, and unpinned Docker images. These changes improve workflow reliability, security, and user experience.

Changes:

• Removed redundant title-prefix values from safe-outputs configurations that were duplicating prefixes already in agent-generated titles
• Added label filtering conditions to pre_activation jobs to prevent workflows from triggering on every opened issue
• Restricted agent permissions in weekly-reminder from --allow-all-tools --allow-all-paths to explicit path allowlists
• Pinned NSIP Docker image to SHA256 digest for supply chain security

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/weekly-reminder.md	Removed redundant "Weekly Farm Check - " title prefix from safe-outputs
.github/workflows/weekly-reminder.lock.yml	Updated compiled workflow: removed title prefix from config JSON and replaced --allow-all-tools --allow-all-paths with explicit --allow-path restrictions
.github/workflows/flock-action.md	Removed redundant "[Flock Action] " title prefix and pinned nsip Docker image to SHA256 digest
.github/workflows/flock-action.lock.yml	Updated compiled workflow: removed title prefix from config JSON, pinned nsip image digest, and added label gate to pre_activation job
.github/workflows/eov-seasonal-reminder.md	Removed redundant "EOV " title prefix from safe-outputs
.github/workflows/eov-seasonal-reminder.lock.yml	Updated compiled workflow: removed title prefix from config JSON
.github/workflows/eov-enrichment.lock.yml	Added multi-label gate to pre_activation job to filter EOV-related issues