refactor: extract Daily Audit Discussion safe-output pattern into shared/daily-audit-discussion.md

[Copilot]

Closes #[issue number]

Summary

Extracts the repeated daily/weekly audit discussion safe-output pattern (present in 42+ workflows) into a new shared component shared/daily-audit-discussion.md, DRYing up ~130+ lines of duplicated configuration.

Changes

Compiler: field-level merging for create-discussion (pkg/workflow/imports.go)

• Modified MergeSafeOutputs so that when a workflow defines create-discussion AND an imported shared component also defines create-discussion, the imported config is not discarded. Instead a new field-level merge fills in any base fields the workflow left unset.
• Added mergeCreateDiscussionsFields helper that merges only "base" fields (category, close-older-discussions, required-category, labels, allowed-labels, footer) from the shared component into the main workflow's config. Workflow-specific fields (title-prefix, expires, max, target-repo, etc.) always come from the main workflow.
• Conflict detection between multiple imports still works: two imported files that both define create-discussion produce an error.

Tests (pkg/workflow/safe_outputs_import_test.go)

Three new tests:

1. TestCreateDiscussionFieldLevelMerge — workflow provides only title-prefix+expires; shared provides category+close-older-discussions; merged result has all fields.
2. TestCreateDiscussionFieldLevelMergeMainTakesPrecedence — main workflow's explicit category overrides the shared component's category.
3. TestCreateDiscussionImportConflictBetweenSharedComponents — two imported files both defining create-discussion still raises a conflict error.

Shared component (.github/workflows/shared/daily-audit-discussion.md)

safe-outputs:
  create-discussion:
    category: "audits"
    max: 1
    close-older-discussions: true
  close-discussion:
    max: 10

Intentionally excludes upload-asset: to avoid conflicts with shared/python-dataviz.md which also provides it.

42 workflows updated

Each updated workflow:

• Adds shared/daily-audit-discussion.md as the first import
• Removes the now-redundant category: "audits", max: 1, close-older-discussions: true lines from create-discussion
• Removes close-discussion: max: 10 blocks (5 workflows that already had this explicitly)
• Retains only workflow-specific fields: title-prefix, expires
• Workflows where create-discussion had only base fields (no title-prefix, no expires) have the block removed entirely — the shared component provides it all

poem-bot.md is intentionally not updated (uses staged: true, max: 2, and custom labels).

Security Summary

CodeQL scan found no alerts. No new dependencies added.