feat(shared): host repo-health-audit shared config in ai-workflows

[JacobPEvans]

Summary

Hosts repo-health-audit-config.md and repo-health-audit-prompt.md in
ai-workflows so consumer repos can import them without tripping a gh-aw
import-path bug specific to .github-named source repos.

Why move from .github?

gh aw's computeImportRelPath
(pkg/parser/import_field_extractor.go) uses
strings.LastIndex("/.github/") to derive the runtime-import macro path.
When the source repo is itself named .github, the runner's cache path
contains TWO /.github/ segments (the workspace's .github folder and
the source repo name) and LastIndex picks the wrong one, producing a
macro that points at a path the runtime cannot find:

ERR_SYSTEM: Runtime import file not found:
.../.github/<SHA>/.github_workflows_shared_repo-health-audit-config.md

This caused every Repo Health Audit run to fail across all 7 consumer
repos for as long as the workflow existed (15+ failures, 0 successes per
consumer at last count).

Moving the shared content to a repo NOT named .github avoids the
collision. Verified end-to-end on ansible-proxmox (test branch
imports from feat/shared-health-audit; full pipeline activation →
agent → detection → safe_outputs → conclusion all succeeded).

Changes

• .github/workflows/shared/repo-health-audit-config.md (new): mirrors
  the config from JacobPEvans/.github (tools, safe-outputs:
  create-issue / add-labels / close-issue).
• .github/workflows/shared/repo-health-audit-prompt.md (new):
  mirrors the audit prompt with two refinements vs the original to
  address review feedback:
  • Step 1 label flow is explicit: create-issue auto-applies
    ai:created, agent invokes add-labels for the rest.
  • "Failed Scheduled Workflows" check is cron-aware: daily-or-more →
    25h window, weekly → 8d, monthly → skipped.

Test Plan

• ansible-proxmox test run from this branch (already verified —
  run 24994312039 all 5 jobs success)
• After merge, propagate the imports: change to the other 6
  consumers, run gh-aw-pin-refresh, confirm next scheduled health
  audit succeeds
• Remove the originals from
  JacobPEvans/.github/.github/workflows/shared/ once all consumers
  are migrated

Migration plan (post-merge)

1. Update each consumer's .github/workflows/repo-health-audit.md to
   import from
   JacobPEvans/ai-workflows/.github/workflows/shared/repo-health-audit-config.md@main
   (and the prompt likewise).
2. Trigger gh-aw-pin-refresh.yml on each consumer to regenerate the
   lockfile.
3. Verify the next scheduled run succeeds.
4. Once all consumers are migrated, the originals in
   JacobPEvans/.github/.github/workflows/shared/ can be deleted.

Affected consumers: ansible-proxmox, ansible-proxmox-apps,
ansible-splunk, orbstack-kubernetes, nix-darwin, nix-home,
nix-ai.

Upstream

Filing a bug at githubnext/gh-aw so this workaround can be retired
once computeImportRelPath anchors on /.github/aw/imports/ instead
of any /.github/ segment. Bug report drafted at
/tmp/gh-aw-upstream-bug-report.md.

Related: #185

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[Copilot]

Pull request overview

This PR adds shared Repo Health Audit configuration and prompt content to ai-workflows so consumer repos can import them from a repository not named .github, avoiding a known gh aw import path collision.

Changes:

• Added a shared health-audit prompt document describing the audit procedure and issue/sub-issue structure.
• Added a shared config document defining tools and safe-outputs constraints for the audit workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/shared/repo-health-audit-prompt.md	New shared prompt text for the Repo Health Audit agent.
.github/workflows/shared/repo-health-audit-config.md	New shared YAML front matter for tools + safe-outputs used by the audit.