fix(workflows): prevent doc-freshness-check from modifying source files

.github/aw/actions-lock.json

@@ -45,11 +45,6 @@
       "version": "v7.0.1",
       "sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
     },
-    "github/gh-aw-actions/setup@v0.75.3": {
-      "repo": "github/gh-aw-actions/setup",
-      "version": "v0.75.3",
-      "sha": "7a3633897dae74a0b11d59c2ad69bf633eb4c4db"
-    },
     "github/gh-aw/actions/setup@v0.68.1": {
       "repo": "github/gh-aw/actions/setup",
       "version": "v0.68.1",

.github/workflows/doc-freshness-check.md

@@ -20,6 +20,9 @@ safe-outputs:
       - README.md
       - docs/**
       - prompts/**
+  create-issue:
+    max: 1
+    labels: [source-code, docs]
 ---
 
 # Documentation Freshness Check
@@ -121,6 +124,18 @@ This file is the primary guide AI agents use when creating new workflow files. D
 - **Common Patterns** — are the YAML examples valid against the current front matter schema?
 - **Key Rules** — is the guidance accurate? (e.g., compile-time validation rules, permission requirements)
 
+## Scope Restriction
+
+**You must only modify documentation files.** Source code files (`.rs`, `.ts`, `.js`, `.toml`, etc.) are strictly out of scope and must **never** be included in your pull request.
+
+When you find drift between documentation and source code, the correct fix is always to **update the documentation to match the source code**, not to modify the source code.
+
+If fixing a discrepancy would require modifying a file outside the `allowed-files` list (`AGENTS.md`, `README.md`, `docs/**`, `prompts/**`), skip that change and **file a GitHub issue** describing the source code inconsistency instead. Use the `create-issue` safe output with:
+- **Title**: `docs: source code inconsistency — [brief summary of the drift]`
+- **Body**: A clear description of what the documentation says versus what the source code actually does, with specific file and line references, so a developer can investigate and fix it.
+
+The `create-issue` safe output is pre-configured with the `source-code` and `docs` labels.
+
 ## Decision Criteria
 
 **Create a pull request** if you find any of the following: