feat: expose safe-output results as workflow_call outputs

[strawgate]

Problem

When a gh-aw workflow is called via workflow_call, the caller has no way to access results from safe-outputs (created issue numbers, PR URLs, push status, etc.). The safe-outputs job sets job-level outputs, but the compiler doesn't generate on.workflow_call.outputs to expose them.

Proposal

1. Publish individual safe-output results as named job outputs — instead of bundling everything into process_safe_outputs_temporary_id_map, each safe-output type should emit its own clearly-named outputs:

   • create_issue → created_issue_number, created_issue_url
   • create_pull_request → created_pr_number, created_pr_url
   • push_to_pull_request_branch → push_commit_sha, push_commit_url
   • add_comment → comment_id, comment_url
   • etc.

2. Wire job outputs to on.workflow_call.outputs — add frontmatter support to declare which outputs to expose:

   outputs:
     issue_number: safe_outputs.created_issue_number
     pr_url: safe_outputs.created_pr_url

   Or automatically expose all safe-output results without explicit declaration.

3. Caller usage:

   jobs:
     run-agent:
       uses: ./.github/workflows/gh-aw-create-issue.lock.yml
     follow-up:
       needs: run-agent
       steps:
         - run: echo "Created issue ${{ needs.run-agent.outputs.issue_number }}"

Why

• Enables chaining agent workflows (e.g., create issue → assign to agent → track results)
• Allows callers to conditionally branch based on safe-output success/failure
• Makes gh-aw workflows composable building blocks in larger automation