[refactor-opportunist] Consolidate duplicated mention-in-issue prompt into shared fragment

## 🏗️ Refactor Proposal

**Summary:** Extract the shared `Issue Assistant` prompt from sandboxed and no-sandbox workflow variants into a single fragment, keeping variant-specific policy knobs in thin wrappers.

## Problem
The two workflow sources below duplicated the same assistant prompt block and repeatedly changed together:

- `.github/workflows/gh-aw-mention-in-issue.md`
- `.github/workflows/gh-aw-mention-in-issue-no-sandbox.md`

Concrete evidence:

- Before this PoC, both files contained near-identical assistant prompt sections (the full `# Issue Assistant` block).
- 60-day churn shows repeated co-edits of both files in the same commits, e.g. `5e6f124`, `f374aab`, `7b41588`, `b4dc41a`, `36593c8`, `a5ecf68`.
- This creates coupling-by-copy: behavior/prompt changes must be manually mirrored across variants, increasing drift risk.

## Proposed Approach
Create a dedicated shared fragment for the common assistant prompt and import it from both workflows.

What changes:

- Shared prompt content moves to one fragment.
- Each workflow keeps only variant-specific differences (e.g., sandbox/threat-detection and concurrency naming).

What stays the same:

- Existing workflow interfaces (`workflow_call` inputs/secrets) and runtime behavior.
- Variant-specific sandbox and safe-output settings.

## Proof of Concept
I partially implemented this refactor on one representative slice (`mention-in-issue` + `mention-in-issue-no-sandbox`) to validate viability.

**Files changed:**

- `.github/workflows/gh-aw-fragments/mention-in-issue-assistant-prompt.md` (new)
- `.github/workflows/gh-aw-mention-in-issue.md`
- `.github/workflows/gh-aw-mention-in-issue-no-sandbox.md`
- `.github/workflows/gh-aw-mention-in-issue.lock.yml` (compiled output)

**Before → After:**

- Before: both workflow files embedded the full `# Issue Assistant` prompt body.
- After:
- Both import `gh-aw-fragments/mention-in-issue-assistant-prompt.md`.
- Prompt body removed from each wrapper workflow.
- `gh-aw-mention-in-issue.md` keeps its wrapper-only trailing instruction block (`inputs.additional-instructions`) after imports.

Key references:

- `.github/workflows/gh-aw-mention-in-issue.md` (imports include new fragment at line 13)
- `.github/workflows/gh-aw-mention-in-issue-no-sandbox.md` (imports include new fragment at line 13)
- `.github/workflows/gh-aw-fragments/mention-in-issue-assistant-prompt.md` (new shared prompt fragment)

**Verification:**

- `make compile` ✅ (including lock-file regeneration)
- `make lint` ✅
- `make test` ⚠️ could not run in this environment (`uv` not installed)

No compile/lint regressions were introduced by the extraction.

## Incremental Rollout Plan
This refactor is incremental and low-risk:

1. **Completed PoC:** consolidate `mention-in-issue` pair onto shared prompt fragment.
2. Apply same pattern to `mention-in-pr` and `mention-in-pr-no-sandbox` shared prompt body.
3. Extend fragmentization to other near-duplicate variant families where only policy toggles differ.

## Risks and Mitigations
- **Risk:** fragment extraction accidentally drops variant-specific instructions.
- **Mitigation:** keep wrappers minimal but explicit; verify compile output and workflow behavior diffs.
- **Risk:** future edits bypass shared fragment and reintroduce duplication.
- **Mitigation:** document fragment intent in `gh-agent-workflows/DEVELOPING.md` shared fragments table.

## Evidence
- Churn/co-change output: `git log --since='60 days ago' --stat -- .github/workflows/gh-aw-mention-in-issue.md .github/workflows/gh-aw-mention-in-issue-no-sandbox.md`
- Implementation diff across the three source files and regenerated lock file from `make compile`.
- No overlap with `/tmp/previous-findings.json` tracked refactor-opportunist issues (#776, #718, #629, #534).

> [!NOTE]
>
> 🔒 Integrity filtering filtered 42 items
>
> Integrity filtering activated and filtered the following items during workflow execution.
> This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.
>
> - resource:search_pull_requests (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:#unknown (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#399](https://github.com/elastic/ai-github-actions/pull/399) (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#704](https://github.com/elastic/ai-github-actions/issues/704) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#831 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#132 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - pr:elastic/ai-github-actions#832 (`pull_request_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#20 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#424](https://github.com/elastic/ai-github-actions/issues/424) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#333 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#325 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#392](https://github.com/elastic/ai-github-actions/pull/392) (`list_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#833 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#823 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#765 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#831 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - ... and 26 more items
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Refactor Opportunist](https://github.com/elastic/ai-github-actions/actions/runs/23750423810)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.