Suggested test: copilot/create-pull-request-with-checkout-step

> [!WARNING]
> **Threat Detection Engine Failure** — The analysis engine could not complete. This is a tooling failure, not a security finding.
>
>
>
> What happened
>
> The threat detection results could not be parsed.
>
> Review the [workflow run logs](https://github.com/githubnext/gh-aw-test/actions/runs/31162929773) for details.
>

## Motivation

Link to the gh-aw PR: github/gh-aw#50907 — fixed a bug where declaring `actions/checkout` in `safe-outputs.steps` caused the compiler to unconditionally inject `contents: read`, downgrading a handler-derived `contents: write` (from `create-pull-request`), which broke `git push`/branch creation with 403s.

## Proposed test

- **Workflow file**: `test-copilot-create-pull-request-with-checkout-step.md`
- **Trigger**: `workflow_dispatch`
- **Engine**: copilot
- **Safe output**: `create-pull-request`, with an explicit `actions/checkout` step added under `safe-outputs.steps`
- **Variant**: standard

## Minimal test prompt sketch

Same prompt as `test-copilot-create-pull-request.md` (create a PR with a patch), but the frontmatter adds a `safe-outputs.steps` block containing an `actions/checkout` step. Assert the compiled lockfile keeps `contents: write` on the safe-outputs job (not downgraded to `read`) and that the PR is created/pushed successfully.

## New fixtures or secrets needed

None — reuse existing `githubnext/gh-aw-test` fixtures and `samples:` pattern from `test-copilot-create-pull-request.md`.

## Notes

This is primarily a compile-time permissions-shape regression check plus a runtime smoke test that the push still succeeds. No existing test declares a custom checkout step under `safe-outputs.steps`, so this scenario is currently uncovered.

> Generated by [🔍 Suggest New E2E Tests](https://github.com/githubnext/gh-aw-test/actions/runs/31162929773) · auto · 34.6 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-test+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-test%2Fsuggest-new-e2e-tests%22&type=issues)

Start by comparing test-copilot-create-pull-request-with-checkout-step.md with test-copilot-create-pull-request.md and its existing samples pattern. Add the workflow_dispatch copilot case with actions/checkout under safe-outputs.steps, then verify the compiled lockfile retains contents: write and that the pull request is created and pushed successfully.

Written by the indexing model from the issue text.