[autonomy-atomicity] Central network ecosystem fragment is a merge-conflict hotspot

## Autonomy / Atomicity Findings

### 1. Shared network allowlist couples unrelated workflow changes
**Category:** God file / Config hotspot
**File(s):** `.github/workflows/gh-aw-fragments/network-ecosystems.md:4-36`; imported by 52 `gh-aw-*.md` workflow sources, including `.github/workflows/gh-aw-autonomy-atomicity-analyzer.md:5-16` and `.github/workflows/gh-aw-bug-hunter.md:5-17`
**Problem:** The fragment contains one repository-wide `network.allowed` list, and every published workflow currently imports it. Adding or removing one ecosystem therefore requires editing the same central file and recompiling all consumers. Concurrent work on unrelated workflows that needs different network access contends on this file; a conflict or partial change can alter network permissions for dozens of workflows at once, rather than remaining scoped to the workflow being changed.
**Suggested fix:** Split the allowlist into narrowly owned capability fragments (or declare only the required ecosystems in each workflow) and import the smallest applicable set. Add validation that prevents workflows from silently losing required network access during the migration.

## Suggested Actions
- [ ] Inventory the actual network dependencies of each workflow and replace the single shared import with scoped capability fragments.
- [ ] Add a lint or compile-time check for required ecosystem declarations and remove the all-workflows dependency on `network-ecosystems.md`.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Autonomy Atomicity Analyzer](https://github.com/elastic/ai-github-actions/actions/runs/29596400774)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

Start with .github/workflows/gh-aw-fragments/network-ecosystems.md:4-36 and trace its imports across the 52 gh-aw-*.md workflow sources, including the autonomy-atomicity and bug-hunter workflows. Inventory each workflow’s actual network dependencies before choosing fragment boundaries. Done means unrelated workflows no longer share one allowlist, and validation detects missing required ecosystem declarations during migration.

Written by the indexing model from the issue text.