fix: don't derive write-sink guard-policy for repos="public"/"all", add guard-policies to stdio schema, and smoke-test guard policy#20749

Copilot wants to merge 5 commits intomaingithub/gh-aw:mainfrom

copilot/review-min-integrity-implementationgithub/gh-aw:copilot/review-min-integrity-implementationCopy head branch name to clipboard