[compiler-threat-spec] docs: extend CTR-004 mapping for enclave GitHub proxy trust surface

[github-actions]

Summary

This PR is a documentation-only update to specs/compiler-threat-detection-spec.md, bumping the spec version from 1.0.27 to 1.0.28. It extends the CTR-004 Sandbox Bypass Configuration mapping table to document the enclave GitHub proxy trust surface (pkg/workflow/enclaves.go, pkg/workflow/enclave_github_proxy.go), which was already implemented and tested but had not previously been reflected in the Section 7.1 mapping table. No compiler behavior changes.

Change Classification

• Type: docs
• Scope: specs/compiler-threat-detection-spec.md
• Breaking: No

Key Changes

File	Change	Impact
specs/compiler-threat-detection-spec.md	Bumped spec version 1.0.27 → 1.0.28; added spec-to-implementation sync table entry (min gh-aw v0.87.4); extended CTR-004 mapping row with enclaves.go/enclave_github_proxy.go and their tests; added 1.0.28 changelog entry	medium

Impact Assessment

• No compiler code, schema, or .lock.yml changes — purely a mapping/documentation update.
• Formally documents existing security controls for the enclaves[].agent.github.cli: issues-read-v1 proxy: AWF network-isolation precondition, AWF/MCPG minimum version gating, a fixed read-only operation allowlist (issues.comments.list, issues.get, issues.list), exclusion of GITHUB_TOKEN from the credential fallback chain, and repository count/sensitivity limits.
• No new CTR-* threat rule introduced; existing CTR-004/CTR-017 coverage is confirmed sufficient.
• No downstream impact on compiled workflows or lock-file compatibility.

Commits

9fa233249 docs: extend CTR-004 mapping for enclave GitHub proxy trust surface

Generated by PR Description Updater for #56521 · copilot · auto · 27 AIC · ⌖ 4.62 AIC · ⊞ 7.7K · ◷

[gh-aw-bot]

@copilot This PR has been quiet since creation. Please refresh the branch if needed, verify checks, and run the pr-finisher skill so the change is ready for maintainer review.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 33.6 AIC · ⌖ 9.8 AIC · ⊞ 6.4K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This PR has been quiet since creation. Please refresh the branch if needed, verify checks, and run the pr-finisher skill so the change is ready for maintainer review.

Generated by [👨�...

Ran the pr-finisher pass:

• Reviews: no open review threads/comments requiring action; this comment is acknowledged here.
• Mergeable: branch is up to date with main (base sha matches), no conflicts, docs-only diff (1 file).
• Checks: three workflow runs (AI Moderator, Content Moderation, Agentic Commands) are stuck at action_required because the PR was opened by github-actions[bot] and require a maintainer approval to run — this isn't something I can trigger from this sandbox (no gh/workflow-dispatch access, and I'm instructed never to trigger workflow runs). No code changes were needed since the content in the last commit is accurate (function names verified against pkg/workflow/enclaves.go / enclave_github_proxy.go).

Nothing else is actionable from the agent side — this PR needs a maintainer to approve the pending workflow runs before it can be merged.