fix(auto-triage): add community and cookie approval-labels and centralize guard policy

.github/workflows/auto-triage-issues.md

@@ -19,11 +19,13 @@ network:
     - defaults
     - github
 imports:
+  - shared/github-guard-policy.md
   - shared/reporting.md
 tools:
   github:
     toolsets:
       - issues
+    min-integrity: approved
   bash:
     - "jq *"
 safe-outputs:
@@ -116,9 +118,11 @@ Apply component labels based on mentioned areas:
 
 - `cli` - Mentions CLI commands, command-line interface, `gh aw` commands
 - `workflows` - Mentions workflow files, `.md` workflows, compilation, `.lock.yml`
+- `compiler` - Mentions `gh aw compile`, `.lock.yml` generation, frontmatter parsing, compilation pipeline
 - `mcp` - Mentions MCP servers, tools, integrations
 - `security` - Mentions security issues, vulnerabilities, CVE, authentication
 - `performance` - Mentions speed, performance, slow, optimization, memory usage
+- `threat-detection` - Mentions threat detection, detection job, `detection_agentic_execution`, safe outputs detection
 
 ### Priority Indicators
 

.github/workflows/daily-doc-updater.md

@@ -35,7 +35,6 @@ tools:
   github:
     toolsets: [default]
     min-integrity: approved
-    approval-labels: [cookie]
   edit:
   bash:
     - "find docs -name '*.md' -o -name '*.mdx'"
@@ -49,6 +48,7 @@ tools:
 timeout-minutes: 45
 
 imports:
+  - shared/github-guard-policy.md
   - uses: shared/qmd.md
     with:
       runs-on: aw-gpu-runner-T4