[instructions] Sync instruction files with recent safe-output and CLI changes

[github-actions]

Instructions janitor pass

Instructions were already synced to v0.88.7 by #60231 on 2026-09-11. This pass covers commits landed after that sync, up to run 34748033754.

Size audit: all .github/aw/*.md files remain under their target limits; no split needed.

Duplication audit: no new duplication introduced; the target: enforcement note was added once to the shared-rules section of safe-outputs.md rather than repeated across every handler that uses target:.

Changes

File	Before -> After	Fix
safe-outputs.md	21 -> 22	Documented that target: "triggering"/fixed-number is enforced, not just validated -- model-supplied issue/PR numbers (incl. temporary-id refs) are ignored unless target: "*". Confirmed against update_handler_factory.cjs from #60362.
safe-outputs-runtime.md	308 -> 310	Added the global body-footer: field (additive with per-handler body-footer:), added in #60275. Confirmed against safe_outputs_config_types.go.
cli-commands.md	329 -> 330	Added gh aw update <package-url-or-name> form from #60452 (package-aware update targets).

Commits reviewed (since 2026-09-11T12:35:55Z sync)

Full diff reviewed: #60536, #60275, #60267, #60362, #60452.
Skimmed for relevance (docs/.github/aw path touched, no instruction change needed): #60531, #60532, #60424, #60346, #60350, #60361, #60348, #60359, #60323, #60310, #60289, #60217.

• Validate external safe-output secrets before activation #60267 (validate external safe-output secrets before activation) -- fails faster at activation time; no new user-facing field, required secrets (JIRA_API_TOKEN, LINEAR_API_KEY, AZURE_DEVOPS_EXT_PAT) were already documented. No change needed.
• Allow aw.yml packages to install shared JavaScript modules #60536 (aw.yml packages can install shared JS modules) -- real gap, but the whole aw.yml package-manifest system (as opposed to single-file gh aw add shared components) isn't covered anywhere in .github/aw/*.md today. Documenting one resource type in isolation would be more confusing than helpful; flagging as a follow-up rather than a partial patch.

No steering-issue comments were available to incorporate -- the run's steering issue number was unset in this invocation's context.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🧹 Instructions Janitor · claude · sonnet50 · 417.2 AIC · ⌖ 32.8 AIC · ⊞ 7.2K · ◷

• expires on Sep 15, 2026, 12:46 AM UTC-08:00

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.89.11