[aw-doctor:compiler-security] Compiler strict-mode actionlint failures in self-care-dashboard-performance.md and self-care-pages-health.md

Compiling all 45 gh-aw workflows in `githubnext/gh-aw-cao` (target sha `b43ef0a4`) failed with exit code 1. actionlint (strict mode) reports 2 errors referencing an undefined step output `safe-outputs-app-token` in the generated lock files for **self-care-dashboard-performance.md** and **self-care-pages-health.md**, so these workflows do not currently pass strict compilation. Compiling also produced uncommitted lock-file drift in 3 files (self-care-data-acquisition-audit, self-care-pages-health, self-care), meaning committed `.lock.yml` files are stale relative to their sources. No container/license/security-scanner (grype/syft/poutine/zizmor/runner-guard) findings were present in the evidence.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `45`
- **Generated lock files checked**: `45`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|------|-----------------|----------|---------|-------------|
| actionlint (strict) | self-care-dashboard-performance.md | error | Line 2283 of generated lock: `steps.safe-outputs-app-token.outputs.token` references a step id (`safe-outputs-app-token`) not present in the referenced job's step outputs type, per actionlint's static expression check | Ensure the `safe-outputs-app-token` step exists and produces `outputs.token` in the job referencing it, or fix the source `.md` to reference the correct step id; recompile until actionlint is clean |
| actionlint (strict) | self-care-pages-health.md | error | Line 2189 of generated lock: same undefined `safe-outputs-app-token` step-output reference | Same as above |
| compiler (git diff) | self-care-data-acquisition-audit, self-care-pages-health, self-care | unknown | Committed `.lock.yml` files differ from freshly compiled output (drift) | Recompile with `gh aw compile` and commit the regenerated lock files |
| gh-aw guard (info) | pr-sous-chef.md | unknown (informational) | `push-to-pull-request-branch` target is `"*"`, allowing pushes to any PR branch with no additional constraints | Consider adding `required-title-prefix:` or `required-labels:` to restrict which PRs can receive pushes |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

```
✗ actionlint failed
.github/workflows/self-care-dashboard-performance.lock.yml:2283:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: {...}; setup: {...}; setup-agent-output-env: {...}}
2283 | GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/self-care-pages-health.lock.yml:2189:26: error: [expression] property "safe-outputs-app-token" is not defined in object type {download-agent-output: {...}; setup: {...}; setup-agent-output-env: {...}}
2189 | GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
```

Diff stat of drifted lock files:
```
.github/workflows/self-care-data-acquisition-audit.lock.yml | 2 +-
.github/workflows/self-care-pages-health.lock.yml | 128 +++++++++++++++------
.github/workflows/self-care.lock.yml | 2 +-
3 files changed, 96 insertions(+), 36 deletions(-)
```

Additional informational note from the guard dry-run report (not a compile error): `push-to-pull-request-branch: target: "*"` in `pr-sous-chef.md` allows pushing to any PR branch with no additional constraints.

Control plane context

- Correlation ID: `34156619218-74`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34156619218

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34156841730) · copilot · auto · 22.3 AIC · ⌖ 9.78 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 21, 2026, 7:52 PM UTC

Start by reading the workflow sources .github/workflows/self-care-dashboard-performance.md and self-care-pages-health.md, then run gh aw compile with strict validation to reproduce the actionlint errors. Review the generated lock-file diffs for self-care-data-acquisition-audit, self-care-pages-health, and self-care, changing only permitted sources. Done means regenerated locks are consistent and the full listed compiler and security scan passes.

Written by the indexing model from the issue text.