Bug: on.needs directive leaks into emitted on: block (invalid Actions YAML)

[dsyme]

Summary

on.needs: is correctly parsed and wired as a dependency on the pre_activation job, but it is never stripped from the emitted on: YAML block in the lock file. This produces invalid GitHub Actions YAML that fails with:

Invalid Argument - failed to parse workflow: (Line: 67, Col: 3): Unexpected value 'needs', (Line: 68, Col: 3): A sequence was not expected

Root Cause

commentOutProcessedFieldsInOnSection() in pkg/workflow/frontmatter_extraction_yaml.go handles steps, permissions, skip-if-match, skip-if-no-match, skip-roles, reaction, lock-for-agent, etc. — but does not handle needs.

The result is that needs: appears literally in the output on: block:

on:
  needs:
  - my_custom_job    # <-- INVALID: not a valid GitHub Actions trigger key
  schedule:
  - cron: "23 * * * *"
  workflow_dispatch:
    ...

Steps to Reproduce

1. Create a workflow with on.needs: referencing a custom job:

on:
  schedule:
    - cron: "23 * * * *"
  workflow_dispatch:
  needs: [study_repo]

jobs:
  study_repo:
    runs-on: ubuntu-latest
    outputs:
      result: ${{ steps.check.outputs.result }}
    steps:
      - id: check
        run: echo "result=success" >> "$GITHUB_OUTPUT"

if: needs.study_repo.outputs.result == 'success'

2. Compile with gh aw compile
3. The lock file on: block contains needs: [study_repo] which GitHub Actions rejects

Expected Behavior

on.needs: should be consumed by the compiler (as it is — correctly wiring pre_activation.needs) and then removed from the emitted on: block, just like on.steps: and on.permissions: are.

Fix Location

pkg/workflow/frontmatter_extraction_yaml.go — add needs to the set of fields that commentOutProcessedFieldsInOnSection() strips from the on: section.

Workaround

Use the "Filtering by Custom Jobs" pattern (just jobs: + if:) instead of on.needs:. The compiler auto-detects the dependency from the if: condition and wires it directly to the activation job. This works correctly but bypasses the pre_activation job entirely (acceptable for scheduled workflows without actor-based filtering).

Compiler Version

gh-aw compile v0.77.3, framework v0.25.56