[refactor-opportunist] Consolidate duplicated create-issue limitations into a shared fragment

## 🏗️ Refactor Proposal

**Summary:** Extract the duplicated `create-issue` limitation text into one shared fragment and import it from both base and scheduled-audit safe-output fragments.

## Problem
`create-issue` limitations are duplicated in two fragments, so policy edits require synchronized updates and can drift.

Concrete evidence:
- `.github/workflows/gh-aw-fragments/safe-output-create-issue.md` (HEAD lines 6-13) contains the 6 limitation bullets.
- `.github/workflows/gh-aw-fragments/safe-output-scheduled-audit-issue.md` (HEAD lines 11-18) repeats the same bullets.
- Churn signal from recent history: both files co-changed in `aa4d10c` and have repeated edits in the last two months.

## Proposed Approach
Create a single fragment for the limitations text and make both existing fragments import it. Keep existing fragment filenames and safe-output config structure unchanged to avoid migration risk.

## Proof of Concept
I partially implemented this refactor on one representative slice to verify viability.

**Files changed:**
- `.github/workflows/gh-aw-fragments/safe-output-create-issue-limitations.md` (new)
- `.github/workflows/gh-aw-fragments/safe-output-create-issue.md`
- `.github/workflows/gh-aw-fragments/safe-output-scheduled-audit-issue.md`

**Before → After:**
- Before:
- `safe-output-create-issue.md` had inline limitation block (lines 6-13).
- `safe-output-scheduled-audit-issue.md` had the same inline limitation block (lines 11-18).
- After:
- Both now contain:
- `@gh-aw-fragments/safe-output-create-issue-limitations.md`
- Shared bullets live once in:
- `.github/workflows/gh-aw-fragments/safe-output-create-issue-limitations.md`

**Verification:**
- `make compile` ✅
- `make lint` ✅
- `make test` ✅ (`32 passed`)

## Incremental Rollout Plan
1. **Completed:** extracted and wired shared `create-issue` limitations fragment for base + scheduled-audit fragments.
2. Apply the same base+overlay pattern to other duplicated safe-output limitation blocks where duplication is verbatim.
3. Add a lightweight CI check that flags duplicate limitation sections across safe-output fragments.

## Risks and Mitigations
- **Risk:** import-order/merge behavior changes in compiled output.
- **Mitigation:** keep existing safe-output YAML blocks in place; only move markdown limitation text.
- **Risk:** hidden downstream dependencies on exact fragment text location.
- **Mitigation:** preserve fragment names and import points; change is additive and local.

## Evidence
- Duplicate text (before):
- `.github/workflows/gh-aw-fragments/safe-output-create-issue.md` lines 6-13
- `.github/workflows/gh-aw-fragments/safe-output-scheduled-audit-issue.md` lines 11-18
- POC diff shows replacement with shared import in both files.
- Validation commands succeeded in workspace (`compile`, `lint`, `test`).

> [!NOTE]
>
> 🔒 Integrity filtering filtered 7 items
>
> Integrity filtering activated and filtered the following items during workflow execution.
> This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.
>
> - [#399](https://github.com/elastic/ai-github-actions/pull/399) (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#392](https://github.com/elastic/ai-github-actions/pull/392) (`list_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#629 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#534 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#718 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#424](https://github.com/elastic/ai-github-actions/issues/424) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#unknown (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Refactor Opportunist](https://github.com/elastic/ai-github-actions/actions/runs/23442471728)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.