Verify aw-compat audit findings (#51044) are already resolved — no code changes required

[Copilot]

The daily cross-repo compatibility audit (#51044) flagged two actionable gaps: a missing codemod for engine: codex combined with a restricted tools.bash allow-list, and a request to surface pull_request_target without checkout: false as a warning outside --strict mode.

Investigation showed both were already resolved prior to this session:

• codex + restricted tools.bash — the guided codemod (bash-allowlist-unsupported-engine-guided-error) landed via PR Add guided gh aw fix diagnostic for restricted tools.bash on engines that ignore allow-listing #51102 (pkg/cli/codemod_bash_allowlist_unsupported_engine.go) and is already on this branch. Reproduced the reported pattern and confirmed gh aw fix now reports a guided manual-fix error instead of "No fixes needed":

  engine:
    id: codex
  tools:
    bash:
      - "gh *"

  ✗ Error processing demo.md: codemod bash-allowlist-unsupported-engine-guided-error failed:
    engine 'codex' does not support bash command allow-listing: ...
  

• pull_request_target without checkout: false — pkg/workflow/pull_request_target_validation.go already emits a non-strict warning (compilation still succeeds) and a hard error under --strict. Verified both modes against a reproduction workflow.

• dotnet/dotnet VMR scope limitation — explicitly flagged by the original reporter as not a gh-aw bug; no action needed.

No source changes were made — this PR only documents the verification performed confirming the audit's action items are already covered by prior merged work (PR #51102 and the existing pull_request_target validation path).

• Fixes [aw-compat] Daily AW compatibility audit: 20 repos, 2 unresolved compile failures, codemods validated in the wild #51044