docs: update agentic-workflows.md to document gh-aw-actions version management and lock file constraints

[github-actions]

Component

Documentation

Bug Description

docs/architecture/agentic-workflows.md mentions that workflow lock files are compiled with gh aw compile, but does not document:

1. That gh-aw-actions version upgrades are managed exclusively through .github/aw/actions-lock.json — not via Dependabot.
2. That *.lock.yml files under .github/workflows/ must never be edited directly; they are generated outputs of gh aw compile and Dependabot is explicitly configured to exclude them.
3. The correct procedure for upgrading gh-aw-actions: bump the version in .github/aw/actions-lock.json, then run gh aw compile to regenerate all *.lock.yml files.

This gap was introduced in commit 214791a (fix(dependabot): exclude gh-aw lock files from automated updates), which added the exclude-paths and exclude-patterns entries to .github/dependabot.yml. Without documentation, contributors may not understand why Dependabot skips these files or how to upgrade the compiler correctly.

Expected Behavior

docs/architecture/agentic-workflows.md (the Workflow Configuration section) should:

• Explain that *.lock.yml files are generated outputs — editing them directly is not supported.
• State that gh-aw-actions is pinned in .github/aw/actions-lock.json and updated by bumping the version there followed by gh aw compile.
• Note that Dependabot excludes *.lock.yml and the github/gh-aw-actions/* action family; upgrades go through actions-lock.json instead.

Steps to Reproduce

1. Read docs/architecture/agentic-workflows.md → Workflow Configuration section.
2. Notice no explanation of how gh-aw-actions version is tracked or why Dependabot does not manage lock files.
3. Compare against .github/dependabot.yml exclude-paths and exclude-patterns entries added in commit 214791a.

Additional Context

• Changed file: .github/dependabot.yml (commit 214791a)
• Relevant doc: docs/architecture/agentic-workflows.md (Workflow Configuration section, ~line 121)
• Lock file ownership comment in dependabot.yml: "Agentic Workflows lock files are generated by gh aw compile; update the source .md workflow instead of accepting direct Dependabot edits here."

Generated by Documentation Update Check · sonnet46 74 AIC · ⌖ 5.75 AIC · ⊞ 7.8K · ◷