[framework-best-practices] Use gh run list to honor agent deep-dive run-count

## Framework / Library Best Practices Findings

### 1. Agent deep-dive silently under-fetches runs above the API page size

**Library:** GitHub CLI (`gh`) and GitHub Actions API

**Location:** `.github/workflows/agent-deep-dive.md:26-29,97-100`

**Evidence:** The workflow exposes a `run-count` input described as the number of recent runs to analyze, with no upper bound. The download step calls `gh api "repos/$GITHUB_REPOSITORY/actions/workflows/$TARGET_WORKFLOW/runs"` once and then slices `.workflow_runs[:$RUN_COUNT]`. The REST list endpoint returns a single page by default, so a request such as `run-count: 100` can only inspect the first page rather than the requested 100 runs.

**What is wrong:** The workflow reports and reasons about fewer runs than the configured input without warning, making scheduled deep dives incomplete for workflows with more than one API page of history.

**Why it matters:** Maintainers can miss failures and trends in the requested analysis window, while the workflow output gives no indication that the window was truncated.

**Simplification:** Replace the custom REST request and `jq` slicing with the GitHub CLI native listing command, for example `gh run list --workflow "$TARGET_WORKFLOW" --limit "$RUN_COUNT" --json databaseId,name,conclusion,createdAt,url`, then normalize the returned fields for the existing log-download loop. `gh run list --limit` handles pagination and directly expresses the intended operation.

**Documentation:** https://cli.github.com/manual/gh_run_list

## Suggested Actions

- [ ] Use `gh run list --limit "$RUN_COUNT"` (or explicitly paginate the REST API) in `.github/workflows/agent-deep-dive.md`.
- [ ] Add a test or validation case covering a `run-count` greater than one API page and confirm the number of selected runs is honored.

> [!WARNING]
>
> Firewall blocked 3 domains
>
> The following domains were blocked by the firewall during workflow execution:
>
> - `awmgmcpg`
> - `docs.astral.sh`
> - `www.mkdocs.org`
>> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "awmgmcpg"
> - "docs.astral.sh"
> - "www.mkdocs.org"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Framework Best Practices](https://github.com/elastic/ai-github-actions/actions/runs/30272098469)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

Start in .github/workflows/agent-deep-dive.md at lines 26-29 and 97-100, and compare the current REST request and jq slicing with gh run list --workflow and --limit. Normalize the command's returned fields for the existing log-download loop. Done means run-count values beyond one API page select the requested number of runs; add or perform a validation case for that range.

Written by the indexing model from the issue text.