[product-manager-impersonator] Safe-outputs replay preflight and run receipt

## Feature Idea

**Summary:** Add fail-fast validation for `agentics-maintenance` safe-output replay inputs and publish a concise replay receipt in the workflow summary.

## Why a Customer Would Want This
Maintainers using `workflow_dispatch` for `operation: safe_outputs` need immediate, actionable feedback when `run_url` is missing/invalid and a clear record of what replay was attempted. Today they must infer failures from raw logs, which slows incident response and increases operator friction.

## Rough Implementation Sketch
- Add a pre-validation step in `.github/workflows/agentics-maintenance.yml` for `operation == safe_outputs` that:
- parses `run_url` (URL or numeric run ID)
- fails with explicit usage guidance when missing/invalid
- Add a lightweight existence/access check for the referenced run before invoking replay.
- Emit a `$GITHUB_STEP_SUMMARY` receipt with source run, parsed run ID, and replay outcome (attempted/succeeded/failed).
- Document expected `run_url` formats and failure modes in `docs/workflows/gh-agent-workflows.md` next to maintenance workflow guidance.

## Why It Won't Be That Hard
This is a narrow, additive change in one workflow path (`apply_safe_outputs`) with existing data already available in dispatch inputs and job environment. It requires no architecture changes, only input validation + summary output + doc update.

## Evidence
- `.github/workflows/agentics-maintenance.yml:53-57` defines `run_url`, but it is optional even for replay.
- `.github/workflows/agentics-maintenance.yml:150` gates on operation only; there is no explicit `run_url` presence/format guard.
- `.github/workflows/agentics-maintenance.yml:181-192` executes replay directly using `GH_AW_RUN_URL` without an explicit preflight step or operator-facing receipt.
- `docs/workflows/gh-agent-workflows.md:147-155` documents installing maintenance workflow, but not replay validation/diagnostic behavior.
- Recent activity indicates this is an active operator pain surface: issue `#869` (docs for replay operation), issue `#886` and `#848` (debuggability gaps in failed runs), PR `#870` and `#885` (maintenance-operation documentation updates).

## Duplicate Check
- Checked open feature/enhancement/idea issues and existing PM impersonator issues.
- Reviewed `/tmp/previous-findings.json` entries and open PM reports.
- This is distinct from `[product-manager-impersonator] Configurable failure-issue reporting for reusable workflows` (`#864`), which focuses on failure-issue noise controls, not replay input validation and execution receipts.

> [!NOTE]
>
> 🔒 Integrity filter blocked 3 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - [#704](https://github.com/elastic/ai-github-actions/issues/704) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#675](https://github.com/elastic/ai-github-actions/pull/675) `list_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - elastic/ai-github-actions#704 `list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Product Manager Impersonator](https://github.com/elastic/ai-github-actions/actions/runs/24130442837)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.