Summary

Ensures every GitHub agentic workflow in .github/workflows runs with unlimited AI credit (token) budgets — no workflow can be cut off mid-run by a credit cap.

The main-agent per-run budget (max-ai-credits: -1) and max-turns were already unlimited across all 19 workflows. The only remaining cap was the threat-detection stage, which fell back to a default of 400 AI credits (GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS || '400').

This PR sets safe-outputs.threat-detection.max-ai-credits: -1 on all 19 workflow .md files and recompiles their .lock.yml files with gh aw compile. With -1, gh-aw omits the maxAiCredits field entirely from the AWF api-proxy config for both the agent and detection stages, so neither is credit-capped.

• 19 workflow .md sources updated (+2 lines each under safe-outputs:).
• 19 .lock.yml files recompiled: the '400' detection default and its shell fallback are gone; detection apiProxy no longer carries a maxAiCredits budget.
• -1 is a schema-valid value for safe-outputs.threat-detection.max-ai-credits (confirmed against gh-aw's frontmatter schema tests).

Note: this also removes the security guardrail budget on the detection stage. If a bounded (but higher) cap is preferred over fully unlimited, the value can be set to a specific number instead.

Test plan

• gh aw compile (v0.81.6): all 19 workflows compiled with 0 errors (remaining warnings are pre-existing and unrelated — /tmp/ prompt refs, slash-command routing, discussion-category casing).
• Verified no .lock.yml file references GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS or the '400' default anymore.
• Verified the detection-stage apiProxy config no longer contains a maxAiCredits budget.