Suggested test: copilot/checkout-safe-output-github-app

## Motivation

Link to the gh-aw PR: github/gh-aw#44444 — Add `checkout.safe-output-github-app` support for safe_outputs checkout auth

PR #44444 added a new `checkout.safe-output-github-app` frontmatter field that allows per-checkout GitHub App credentials for safe_outputs git operations in cross-repo PR/push flows. There is no E2E test exercising this auth path.

## Proposed test

- **Workflow file**: `test-copilot-siderepo-checkout-safe-output-github-app.md`
- **Trigger**: `workflow_dispatch`
- **Engine**: copilot
- **Safe output**: `push-to-pull-request-branch` (cross-repo, via siderepo checkout)
- **Variant**: `siderepo` — the scenario is cross-repo and needs `githubnext/gh-aw-side-repo` as the target

## Minimal test prompt sketch

Create a new branch in `githubnext/gh-aw-side-repo` and push a small file change using the `push-to-pull-request-branch` safe output. The checkout block should include `safe-output-github-app` pointing to the repo's existing GitHub App credentials so that the safe_outputs git operations use app auth rather than the default token.

## New fixtures or secrets needed

Requires a GitHub App (client-id + private key) registered on `githubnext/gh-aw-side-repo` with `contents: write` permission, stored as repository secrets (e.g. `SAFE_OUTPUT_APP_CLIENT_ID` and `SAFE_OUTPUT_APP_PRIVATE_KEY`). This is the primary blocker — need to confirm whether such an app already exists or one must be provisioned.

## Notes

The `siderepo` variant of `push-to-pull-request-branch-using-dispatch` already exercises cross-repo push auth via the default token. This new test would specifically validate the `safe-output-github-app` code path added in #44444, which has no current E2E coverage.

> [!WARNING]
>
> Firewall blocked 1 domain
>
> The following domain was blocked by the firewall during workflow execution:
>
> - `awmgmcpg`
>> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "awmgmcpg"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

> Generated by [🔍 Suggest New E2E Tests](https://github.com/githubnext/gh-aw-test/actions/runs/29009122314) · 97.4 AIC · ⌖ 8.19 AIC · ⊞ 5.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-test+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-test%2Fsuggest-new-e2e-tests%22&type=issues)

Start by reviewing test-copilot-siderepo-checkout-safe-output-github-app.md and the existing siderepo push-to-pull-request-branch-using-dispatch test. Confirm whether the target repository already has the required GitHub App credentials before setting up the workflow. Done means the workflow_dispatch E2E test creates a branch and pushes a small change through safe-output-github-app authentication.

Written by the indexing model from the issue text.