feat: add maintainer issue investigation workflow

[huzaifa-d]

📖 Description

Adds a maintainer-triggered /investigate Agentic Workflow that:

• Checks whether an issue is valid under the current code, tests, and documentation.
• Posts a report with assessment, classification, evidence, and recommended next step.
• Requests missing details from the issue author when there is insufficient information.
• Creates a draft PR only for a small, unambiguous documentation or test-only fix.

Plus hardens automatic issue triage against untrusted issue content.

✅ Checklist

• Signed the Contributor License Agrement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Adds a maintainer-triggered /investigate GitHub Agentic Workflow (gh-aw) for evidence-backed issue investigation (optionally creating one narrow draft docs/tests PR), and updates the existing issue-triage workflow to (a) harden against prompt injection from issue text and (b) advertise /investigate when triage successfully routes an issue.

Changes:

• Introduces a new Issue Investigation gh-aw workflow (/investigate) with strict safe-output limits (max 1 public comment + max 1 draft PR, docs/tests paths only).
• Hardens Issue Triage instructions to treat issue content as untrusted evidence and appends a maintainer /investigate callout when routing succeeds.
• Documents the intended behavior/safety model in CONTRIBUTING.md and new design spec docs.

Show a summary per file

File	Description
docs/superpowers/specs/2026-07-21-triage-investigation-discovery-design.md	New spec describing how triage comments should advertise /investigate (needs small accuracy fixes).
docs/superpowers/specs/2026-07-17-issue-investigation-design.md	New design doc defining goals, scope limits, and safety constraints for /investigate.
CONTRIBUTING.md	Adds contributor-facing documentation for the /investigate workflow and its safety boundaries.
.github/workflows/issue-triage.md	Updates triage instructions for untrusted content + adds /investigate discoverability paragraph and PR read permission.
.github/workflows/issue-triage.lock.yml	Regenerated gh-aw lockfile for the triage workflow.
.github/workflows/issue-investigation.md	New gh-aw workflow implementing /investigate with strict safe outputs and path guards.
.github/workflows/issue-investigation.lock.yml	Generated gh-aw lockfile for the new investigation workflow.

Review details

Comments suppressed due to low confidence (1)

docs/superpowers/specs/2026-07-21-triage-investigation-discovery-design.md:25

• "Scope and Safety" states this changes only the triage comment content, but this PR also changes the Issue Triage workflow permissions (adds pull-requests: read). Either drop that permission if it’s not required, or update this spec so it accurately describes the full scope of the change.

This changes only the explanatory content of the Issue Triage comment. It does
not change the triage trigger, roles, label or assignment rules, safe outputs,
or the `/investigate` workflow's permissions and limits.

• Files reviewed: 6/7 changed files
• Comments generated: 1
• Review effort level: Low

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[bbonaby]

excited to see what the bot does 😊