Raise Security Guard engine turn budget

[Copilot]

Security Guard exhausted its six-invocation limit after transient engine retries, returning HTTP 429 before emitting a terminal safe output.

• Increase the workflow budget from 6 to 10 turns.
• Regenerate the compiled workflow lock with the matching runtime limits.
• Update the workflow regression test expectations.

max-turns: 10

• Fixes [aw] Security Guard hit engine rate limit (HTTP 429) #10048

[Copilot]

🟢 Approval recommended

The source, compiled proxy limit, and runtime environment consistently use 10, with no blocking issues identified.

0 open findings

What changed in this PR

Raises Security Guard’s invocation budget to allow more room for transient retries before producing a terminal safe output, addressing #10048.

Changes:

• Increase source and compiled runtime limits from 6 to 10.
• Update regression expectations for the larger budget.

File	Description
scripts/​ci/​security-guard-workflow.test.ts	Expect the 10-turn budget.
.github/​workflows/​security-guard.md	Set max-turns to 10.
.github/​workflows/​security-guard.lock.yml	Update compiled limits and metadata.

🧠 Review effort: Max

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.19%	93.20%	📈 +0.01%
Statements	91.76%	91.77%	➡️ +0.01%
Functions	90.68%	90.68%	➡️ +0.00%
Branches	85.63%	85.64%	📈 +0.01%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/enclave/host-executor-server.ts	90.8% → 90.8% (+0.00%)	89.2% → 89.5% (+0.30%)
src/log-directory-setup.ts	96.8% → 100.0% (+3.18%)	96.9% → 100.0% (+3.13%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts