[product-manager-impersonator] Explain safe-output expiration before auto-closing

## Feature Idea

**Summary:** Add a concise, configurable comment before `agentics-maintenance` closes an expired issue, pull request, or discussion so maintainers can distinguish expiration from a human resolution.

## Why a Customer Would Want This

Teams using scheduled audits rely on safe outputs for actionable reports, but an expired item can currently disappear into the normal closed state without an obvious explanation. A maintainer reviewing history should be able to tell that the item reached its retention window, which workflow created it, and where to look for the originating run instead of reopening investigations or assuming someone resolved it manually.

## Rough Implementation Sketch

- Extend the expiration handling used by `agentics-maintenance` to add a short marker comment immediately before closing an expired issue, pull request, or discussion.
- Include the expiration reason, close timestamp, originating workflow/expiration key when available, and originating run URL when safe-output metadata provides it.
- Add a small opt-out or message setting in the maintenance workflow if repositories need silent cleanup, and document the resulting lifecycle next to the existing `expires` guidance.
- Add focused coverage for each entity type and preserve the current close behavior when commenting is disabled or metadata is unavailable.

## Why It Won’t Be That Hard

Expiration is already centralized: the shared safe-output configuration sets `expires: 7d`, while one maintenance workflow owns the close-expired jobs and already has write permissions for discussions, issues, and pull requests. This is an additive notification step around the existing close calls rather than a new persistence or scheduling system.

## Evidence

- `.github/workflows/gh-aw-fragments/safe-output-scheduled-audit-issue.md:1-8` configures scheduled audit issues with a seven-day expiration.
- `.github/workflows/agentics-maintenance.yml:90-128` centralizes closing expired discussions, issues, and pull requests through the three `close_expired_*` scripts, but defines no repository-facing expiration notice.
- `docs/workflows/gh-agent-workflows.md:134-142` tells consumers that expired safe-output entities are closed automatically, making the close-notification behavior the natural place to improve lifecycle clarity.
- This is distinct from existing replay receipts (#893) and scheduled cooldown windows (#1169): it explains individual expired entities at close time rather than validating replay inputs or suppressing duplicate reports.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Product Manager Impersonator](https://github.com/elastic/ai-github-actions/actions/runs/29088053169)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

Start with .github/workflows/agentics-maintenance.yml:90-128 and trace the three close_expired_* scripts for discussions, issues, and pull requests. Read the safe-output configuration in .github/workflows/gh-aw-fragments/safe-output-scheduled-audit-issue.md and the lifecycle guidance in docs/workflows/gh-agent-workflows.md. Done means each entity can receive the configured expiration notice before closing, with metadata-aware behavior, opt-out support, documentation, and focused coverage while preserving silent close behavior when disabled or metadata is unavailable.

Written by the indexing model from the issue text.