Add git hooks and DESIGN.md to protected-files defaults and sync docs

[Copilot]

This PR expands the default protected-files coverage for safe outputs and keeps the reference documentation aligned with those defaults.

Changes Made

• Added DESIGN.md to the default basename-protected files.
• Added .githooks/ and .husky/ to default protected path prefixes.
• Updated focused workflow tests to assert the new protected file/path defaults.
• Updated documentation in docs/src/content/docs/reference/safe-outputs-pull-requests.md so the protected files/paths list matches runtime behavior.

Validation

• Ran formatting and focused tests for the changed workflow package files.
• Ran make agent-finish and captured pre-existing unrelated baseline failures.
• Ran parallel validation (Code Review + CodeQL).

[pelikhan]

@copilot maintain the list of protected files/paths in the docs too

[Copilot]

Pull request overview

Updates the workflow safe-outputs “protected files” defaults to cover design documentation and repository-tracked git hook scripts, and extends tests to validate the new defaults.

Changes:

• Add DESIGN.md to the default protected file basenames.
• Add .githooks/ and .husky/ to the default protected path prefixes.
• Update/create focused tests to assert these new defaults in generated configs.

Show a summary per file

File	Description
pkg/workflow/runtime_definitions.go	Extends default protected basenames and path prefixes (DESIGN.md, .githooks/, .husky/).
pkg/workflow/safe_outputs_config_generation_test.go	Asserts new defaults appear in generated create_pull_request safe-outputs config.
pkg/workflow/compiler_safe_outputs_config_test.go	Updates protected-files exclusion test expectations and adds assertions for default protected path prefixes.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 1

[Copilot]

The conversion of protected_path_prefixes from []any to []string silently drops non-string values (if s, ok := v.(string); ok { ... }). This can mask a serialization/type regression in the config. Consider asserting each element is a string (fail fast) and/or using a small helper to parse []any -> []string to avoid duplicating this pattern.

[Copilot]

@copilot maintain the list of protected files/paths in the docs too

Updated docs to keep the protected defaults list in sync: added DESIGN.md, .githooks/, and .husky/ in safe-outputs-pull-requests.md (commit a3b2960). No UI changes were involved.