[product-manager-impersonator] Add stable-key upsert issue safe output

Add a safe output that deterministically creates or updates one bot-owned issue using a stable caller-supplied key, so scheduled audits and event-driven diagnostics can refresh a durable finding instead of creating issue churn.

Evidence:
- `safe-output-create-issue.md:2-14` supports creation only; the existing update primitive is PR-specific in `safe-output-update-pr.md:2-15`.
- The branch failure workflow is event-driven (`branch-actions-detective/example.yml:3-5,16-19`), while its guidance says to “create or update” but currently directs existing findings to `noop` (`gh-aw-branch-actions-detective.md:95,138-143`).
- Scheduled audits rely on title-prefix matching and optional close-old behavior (`gh-aw-scheduled-audit.md:46-49,84-102`), which can still produce churn rather than refresh one durable report.
- Workflow-call outputs already expose created issue numbers/URLs (`docs/upgrading.md:11-14`), offering a natural extension point.

Implementation sketch:
- Add `safe-outputs.upsert-issue` with a required stable `key`, plus body/title/labels and a maximum of one operation per run.
- Store a hidden sanitized key marker, find a matching bot-owned issue, and update it; otherwise create it. Enforce repository/workflow ownership boundaries and existing safe-output limits.
- Return `issue_number`, `issue_url`, and `operation: created|updated|noop`.
- Add a shared fragment, scheduled and event-driven examples, and runtime contract tests; update the compiler/runtime dependency as needed.

Feasibility: Medium. The repository primarily authors gh-aw workflow sources/fragments (`DEVELOPING.md:36-40`), so the core handler likely belongs upstream in gh-aw, followed by a compiler-version update and source-only template changes.

Duplicate check: No hand-authored source contains `upsert-issue`, `update-issue`, or an idempotency-key capability. This is distinct from safe-output expiration, audit cooldown, comment outputs, scheduled outcome outputs, replay receipts, and concurrency guardrails: it provides deterministic issue identity and in-place refresh rather than time-based suppression or run reporting.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Product Manager Impersonator](https://github.com/elastic/ai-github-actions/actions/runs/29408497900)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

Read safe-output-create-issue.md, safe-output-update-pr.md, gh-aw-branch-actions-detective.md, and gh-aw-scheduled-audit.md to trace current issue creation and update guidance. Check DEVELOPING.md and the cited workflow-call outputs to determine the source-template and compiler-version work, then identify the upstream gh-aw handler and runtime contract tests needed to verify created, updated, and noop results.

Written by the indexing model from the issue text.