feat(ci): implement P0 agentic workflow improvements

[Copilot]

Implements three P0 agentic workflow improvements from the Pelis Agent Factory Advisor assessment to improve automation coverage.

Issue Monster Fix

• Changed issues: read → issues: write permission
• Workflow was running but failing on assign_to_agent step due to insufficient permissions

Documentation Sync Workflow (NEW)

• Triggers on code changes to src/, containers/, scripts/
• Detects code-documentation drift by comparing CLI help, env vars, and configs against docs
• Creates issues with [Docs Sync] prefix and documentation, automated labels

Test Coverage Improver Workflow (NEW)

• Daily schedule to identify under-tested code
• Prioritizes security-critical paths: iptables rules, Squid config, domain filtering
• Creates issues with [Coverage] prefix and test, automated, good first issue labels

Both new workflows follow existing patterns (imports shared/mcp-pagination.md, uses create-issue safe output).

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[plan] Implement P0 agentic workflow improvements</issue_title>
<issue_description>## Overview

This tracking issue covers the implementation of P0 (highest priority) agentic workflow improvements identified in the Pelis Agent Factory Advisor assessment.

Source: Discussion #304

Assessment Summary

The repository currently has strong security automation but opportunities exist in documentation automation, test coverage, and issue management. This plan focuses on the three P0 recommendations with immediate ROI and low-to-medium implementation effort.

Planned Tasks

1. Enable Issue Monster - Activate existing but dormant issue-monster workflow (0 runs despite configuration)
2. Documentation Sync Workflow - Create workflow to detect code-documentation drift and maintain docs
3. Test Coverage Improver - Daily workflow to identify under-tested code and improve coverage

Success Criteria

• Issue Monster processing 1-3 issues per hour automatically
• Documentation stays synchronized with code changes
• Test coverage systematically improved, especially for security-critical paths

Timeline

• Week 1: Enable Issue Monster
• Month 1: Documentation sync and test coverage workflows operational

AI generated by Plan Command for discussion #304

Comments on the Issue (you are @copilot in this section)

• Fixes [plan] Implement P0 agentic workflow improvements #313

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Mossaka]

@copilot please generate the github action yamls and push

[Copilot]

@copilot please generate the github action yamls and push

The .lock.yml files are generated by the gh aw compile command from the gh-aw extension. I cannot run this command in this environment as it requires authenticated GitHub CLI access to install and execute the extension.

To generate the workflow YAMLs, please run locally:

gh extension install githubnext/gh-aw  # if not installed
gh aw compile docs-sync
gh aw compile test-coverage-improver

This will generate docs-sync.lock.yml and test-coverage-improver.lock.yml from the .md workflow definitions I created.