[gh-aw-upgrade] gh-aw upgrade available: v0.87.1 → v0.89.1

A new version of gh-aw is available. We are currently on `v0.87.1`, latest is `v0.89.1`.

## Upgrade Assessment

**Urgency:** Critical

## Relevant Changes

### v0.88.0

#### Breaking Changes
- **Removed built-in Playwright MCP support**: release notes state browser automation now goes through Playwright CLI guidance instead of the bundled Playwright MCP server.
- **Impact on our workflows**: we still import `gh-aw-fragments/playwright-mcp-explorer.md` in 10 workflow sources:
- `.github/workflows/gh-aw-create-pr-from-issue.md:13`
- `.github/workflows/gh-aw-create-comment-on-issue.md:13`
- `.github/workflows/gh-aw-internal-gemini-cli.md:13`
- `.github/workflows/gh-aw-issue-triage.md:13`
- `.github/workflows/gh-aw-mention-in-issue-by-id.md:13`
- `.github/workflows/gh-aw-mention-in-issue-no-sandbox.md:13`
- `.github/workflows/gh-aw-mention-in-issue.md:13`
- `.github/workflows/gh-aw-mention-in-pr-no-sandbox.md:15`
- `.github/workflows/gh-aw-mention-in-pr.md:16`
- `.github/workflows/gh-aw-scheduled-audit.md:12`
- **Direct evidence in fragment**: `.github/workflows/gh-aw-fragments/playwright-mcp-explorer.md` still defines `tools.playwright` and MCP `browser_*` tool usage (`Playwright MCP tools`, `browser_navigate`, etc.).

#### Bug Fixes
- **Nested import ordering/cycle detection fix** in v0.88.0 is relevant because our workflows rely heavily on shared fragment imports.

### v0.88.7

#### Security
- **Fail-fast on incomplete agent work** and **artifact packaging restrictions** improve reliability/safety of scheduled detector/reporter runs that depend on safe outputs.

### v0.89.1

#### Bug Fixes
- Additional guard-policy and credential/permission hardening landed after our pinned version.

## Upgrade Steps

- [ ] Update `GH_AW_VERSION` in `Makefile` from `v0.87.1` to `v0.89.1`
- [ ] Replace `gh-aw-fragments/playwright-mcp-explorer.md` usage with the Playwright CLI pattern expected by current gh-aw (or remove Playwright dependency where not needed)
- [ ] Re-run `make compile` and resolve any compiler/runtime profile incompatibilities surfaced by newer gh-aw versions
- [ ] Validate the 10 affected workflows listed above with a focused dry run

> Generated by [Internal: Upgrade Check](https://github.com/elastic/ai-github-actions/actions/runs/34482731111) · gpt53codex · 103.1 AIC · ⌖ 3.41 AIC · ⊞ 23.5K · [◷](https://github.com/search?q=repo%3Aelastic%2Fai-github-actions+is%3Aissue+%22gh-aw-workflow-call-id%3A+elastic%2Fai-github-actions%2Fupgrade-check%22&type=issues)
> - [x] expires on Sep 17, 2026, 1:38 PM UTC

Start with GH_AW_VERSION in Makefile and read .github/workflows/gh-aw-fragments/playwright-mcp-explorer.md alongside the 10 listed workflow sources. Run make compile, then perform the focused dry run described in the issue to identify compatibility problems. Done means the version is v0.89.1, affected workflows no longer rely on the incompatible fragment usage, and compilation and validation succeed.

Written by the indexing model from the issue text.