[framework-best-practices] Remove unnecessary compatibility compiler setup and destructive compile cleanup

## Framework / Library Best Practices Findings

### 1. Avoid installing the compatibility compiler when no workflows require it
**Library:** GNU Make (the repository build tool)
**Library feature:** Conditional prerequisites and conditional targets.
**Current code:** `Makefile:14` defines `GH_AW_COMPAT_WORKFLOWS :=` as empty, but `Makefile:193` always declares `setup-gh-aw-compat` as a prerequisite of `compile`. The compatibility compiler is only invoked conditionally at `Makefile:197-203` when that variable is non-empty.
**What is wrong:** Every `make compile` downloads or installs `.bin/gh-aw-compat` even though the current configuration has no compatibility workflows to compile.
**Why it matters:** Local development and CI perform an unnecessary second compiler installation, adding network work and failure surface to every compile while producing no output.
**Simplification:** Make `setup-gh-aw-compat` a conditional prerequisite, or split compatibility compilation into a conditional target, so it runs only when `GH_AW_COMPAT_WORKFLOWS` is non-empty.
**Documentation:** (www.gnu.org/redacted)

### 2. Use Git pathspec exclusion instead of mutating the workspace during compile verification
**Library:** Git
**Library feature:** Excluded pathspecs in `git status`.
**Current code:** `.github/workflows/ci.yml:56-63` runs `git checkout -- .github/workflows/agentics-maintenance.yml` after `make compile`, then checks `git status`.
**What is wrong:** The CI check discards the generated file's post-compile contents before checking for drift, mutating the checkout solely to hide one expected change.
**Why it matters:** Destructive cleanup can mask unrelated modifications to that file and makes verification depend on a side effect rather than expressing the intended exception.
**Simplification:** Keep the workspace intact and use an excluded pathspec, for example `git status --porcelain --untracked-files=all -- . :(exclude).github/workflows/agentics-maintenance.yml`, then fail if the filtered status is non-empty.
**Documentation:** (gitscm.com/redacted)

## Suggested Actions
- [ ] Make the compatibility compiler prerequisite conditional on `GH_AW_COMPAT_WORKFLOWS`.
- [ ] Replace the `git checkout --` step with an excluded-path `git status` check.

> [!WARNING]
>
> Firewall blocked 4 domains
>
> The following domains were blocked by the firewall during workflow execution:
>
> - `gitscm.com`
> - `squidfunk.github.io`
> - `www.gnu.org`
> - `www.mkdocs.org`
>> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "gitscm.com"
> - "squidfunk.github.io"
> - "www.gnu.org"
> - "www.mkdocs.org"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Framework Best Practices](https://github.com/elastic/ai-github-actions/actions/runs/29835043278)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

Start with Makefile lines 14, 193, and 197-203, then inspect .github/workflows/ci.yml lines 56-63. Run make compile and the relevant CI verification to confirm the compatibility compiler is skipped when no workflows are configured, the workspace is not destructively changed, and filtered status reports only unexpected changes.

Written by the indexing model from the issue text.