Migrate runtime threat scan to CopilotRequestWrite

[Copilot]

This updates the remaining agentic workflow to the current Copilot auth model and refreshes its generated lock file with the latest gh-aw release output. The workflow now requests Copilot access via workflow permissions instead of the deprecated feature flag / secret path.

• Workflow source

  • Replaced features.copilot-requests: true with permissions.copilot-requests: write in daily-runtime-threat-scan.md.
  • Kept the existing read scopes intact.

• Generated workflow

  • Recompiled daily-runtime-threat-scan.lock.yml with gh-aw v0.79.6.
  • Picked up the current compiler metadata, action/runtime pins, and concurrency shape from the latest release.

• Copilot auth path

  • Removed the generated COPILOT_GITHUB_TOKEN secret verification and secret redaction entries tied to the old flow.
  • Switched the generated agent job to use the workflow token-backed Copilot request permission.

permissions:
  contents: read
  copilot-requests: write
  issues: read

[Copilot]

Pull request overview

This pull request migrates the remaining runtime threat-scan agentic workflow to the current Copilot authentication model by requesting Copilot access via workflow/job permissions, and refreshes generated workflows to match the latest gh-aw compiler output.

Changes:

• Updated the workflow source to request Copilot via permissions.copilot-requests: write (removing the deprecated features.copilot-requests flag).
• Recompiled the generated lock workflow with gh-aw v0.79.6, picking up updated pins/metadata and updated job/concurrency structure.
• Added the generated agentics-maintenance.yml workflow (emitted by gh-aw when safe-outputs use expires).

Show a summary per file

File	Description
.github/workflows/daily-runtime-threat-scan.md	Switches Copilot access from deprecated feature flag to workflow permissions (copilot-requests: write).
.github/workflows/daily-runtime-threat-scan.lock.yml	Regenerated compiled workflow with gh-aw v0.79.6, including updated pins/metadata and the new Copilot permission-based auth path.
.github/workflows/agentics-maintenance.yml	Adds the generated maintenance workflow to manage expiration-based maintenance tasks emitted by gh-aw.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 0

[github-advanced-security]

zizmor found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.