feat(workflows): add gh-aw agentic code scanning issue creation workflow

Summary

Add a standalone GitHub Agentic Workflow (gh-aw) that creates and updates
security backlog issues from code scanning alerts with contextual, narrative-rich
bodies — as a supplemental layer on top of the existing programmatic workflow.

Background

The existing create-gh-code-scanning-issues.yml uses bash templating for
deterministic, zero-cost issue creation (Scenario A). However, it cannot
contextually explain repo-level security rules (e.g., Scorecard
BranchProtectionID) that have no affected file paths. A gh-aw workflow using
the GitHub Backlog Manager agent and the code_security MCP toolset can provide
narrative issue bodies and handle rule-type distinctions automatically.

Approach

• New file: .github/workflows/create-code-scanning-issues.md (gh-aw source)
• Compiled output: .github/workflows/create-code-scanning-issues.lock.yml
• Trigger: workflow_run: on "Weekly GitHub Code Scanning", conclusion: success, branches: [main]
• Imports: .github/agents/github/github-backlog-manager.agent.md
• Toolsets: issues, code_security (reads alerts live — no artifact dependency)
• Permissions: issues: write, security-events: read
• Pattern: report workflow (see agentic-workflows.agent.md)

Constraints

• This is additive — create-gh-code-scanning-issues.yml (programmatic) is
  not removed; the gh-aw workflow is a supplemental enrichment layer
• workflow_call: is not a first-class gh-aw trigger; workflow_run: is used instead
• add-comment safe-output must be declared alongside create-issue to support
  the existing-issue update path
• Must be compiled via gh aw compile before merging

Prerequisites

• Scenario A (programmatic workflow improvements) must be merged first
• Verify code_security toolset availability in the gh-aw runtime environment

References

• Research: .copilot-tracking/research/2026-05-01/gh-code-scanning-issue-creation-research.md (Scenario D section)
• gh-aw subagent research: .copilot-tracking/research/subagents/2026-05-01/gh-aw-backlog-manager-research.md
• gh-aw docs: https://github.github.com/gh-aw/introduction/overview/
• Existing agentic workflow pattern: .github/workflows/doc-update-check.md

Start with .github/workflows/create-code-scanning-issues.md, the existing create-gh-code-scanning-issues.yml, and .github/workflows/doc-update-check.md; then read the referenced gh-aw research and agent files. Compile with gh aw compile and verify the generated create-code-scanning-issues.lock.yml uses the stated trigger, permissions, toolsets, and safe outputs while preserving the existing workflow.