[aw] Monthly PR Clusters engine driver failed before emitting a terminal safe output #586

The agentic workflow monthly-pr-clusters encountered repeated permission denied errors for these commands:
`shell(find /home/runner/work/rig/rig -name "SKILL.md" -o -name "run.ts" 2>/dev/null | head -20)`, `shell(find /tmp/gh-aw/repo-memory/pr-cluster-rigs/ -type f -name "*.json" 2>/dev/null | head -20)`, `shell(cat /tmp/gh-aw/agent/merged-prs.json | jq '.prs | length' 2>/dev/null)`, `shell(rm /tmp/gh-aw/agent/pr-cluster-rig.ts)`, `shell(cat > /tmp/gh-aw/agent/pr-input.json << 'EOF'`

Please update the workflow prompt so the agent:
1. Uses built-in tools (GitHub API, file read/write) instead of the denied shell commands
2. Or achieves the same goal through alternative approaches that do not require shell permission

engine_driver_failure
Agent finished without emitting a terminal safe output; task completion could not be confirmed.
skill: {"message":"Skill not found: rig","code":"failure"}
bash: find /home/runner/work/rig/rig -name "SKILL.md" -o -name "run.ts" 2>/dev/null | head -20: {"message":"The user rejected this tool call. User feedback: Tool invocation is not allowed by workflow tool permissions.","code":"denied"}
bash: find /tmp/gh-aw/repo-memory/pr-cluster-rigs/ -type f -name "*.json" 2>/dev/null | head -20: {"message":"The user rejected this tool call. User feedback: Tool invocation is not allowed by workflow tool permissions.","code":"denied"}
bash: cat /tmp/gh-aw/agent/merged-prs.json | jq '.prs | length' 2>/dev/null: {"message":"The user rejected this tool call. User feedback: Tool invocation is not allowed by workflow tool permissions.","code":"denied"}
create: {"message":"Path already exists","code":"failure"}
bash: rm /tmp/gh-aw/agent/pr-cluster-rig.ts: {"message":"The user rejected this tool call. User feedback: Tool invocation is not allowed by workflow tool permissions.","code":"denied"}
bash: cat > /tmp/gh-aw/agent/pr-input.json << 'EOF'
{
  "prs": [
    {"number": 523, "title": "[rig-tasks] Add 10 rig samples — 2026-09-01", "labels": ["automation", "ai-agent"]},
    {"number": 524, "title": "[rig-claude] Improve Claude dynamic-workflow compatibility for rig", "labels": ["automation", "ai-agent"]},
    {"number": 532, "title": "Bump `@vitest/mocker` and vitest", "labels": ["dependencies", "javascript"]},
    {"number": 537, "title": "Upgrade agent runtimes and fix Copilot SDK integration", "labels": []},
    {"number": 538, "title": "Bump source-map-js from 1.2.1 to 1.2.2", "labels": ["dependencies", "javascript"]},
    {"number": 540, "title": "Fix Rig skill metadata and standalone manifest", "labels": []},
    {"number": 541, "title": "Harden agent engine integrations and document provider capabilities", "labels": []},
    {"number": 542, "title": "Add three-judge Rig skill integration workflow using Copilot SDK", "labels": []},
    {"number": 544, "title": "Replace source-map-js with a local source-map adapter", "labels": []},
    {"number": 545, "title": "Refresh workflows with gh-aw v0.91.1 prerelease", "labels": []},
    {"number": 546, "title": "Simplify installed skill bootstrap to a Node-only entry point", "labels": []},
    {"number": 548, "title": "Improve Rig bootstrap prompts and 1ES dependency compatibility", "labels": []},
    {"number": 550, "title": "Fix Rig workflow SDK credential handoff with a harness-owned launch tool", "labels": []},
    {"number": 558, "title": "Fix Pi Rig invocation with a managed SDK extension and upgrade gh-aw", "labels": []},
    {"number": 560, "title": "Fix and validate Codex Rig workflow integration", "labels": []},
    {"number": 563, "title": "Fix landing diagram overflow and empty preview padding", "labels": []},
    {"number": 566, "title": "Upgrade agentic workflows to gh-aw v0.91.4", "labels": []},
    {"number": 568, "title": "[rig-header] Update rig.ts agentic file-summary header", "labels": ["automation", "ai-agent"]},
    {"number": 569, "title": "Make the Rig README a compact quick start", "labels": []},
    {"number": 574, "title": "[rig-tasks] Add 10 rig samples — 2026-10-07", "labels": ["automation", "ai-agent"]},
    {"number": 579, "title": "Add DeepSeek Harness support and three-judge workflow", "labels": []},
    {"number": 581, "title": "Recover decomposition benchmark from empty generated source", "labels": []},
    {"number": 583, "title": "Add monthly PR clustering with evolving Rig strategies", "labels": []}
  ],
  "window": {
    "start": "2026-09-07T20:30:31.906Z",
    "end": "2026-10-07T20:30:31.906Z"
  }
}
EOF
cat /tmp/gh-aw/agent/pr-input.json | head -20: {"message":"The user rejected this tool call. User feedback: Tool invocation is not allowed by workflow tool permissions.","code":"denied"}
Driver exit code: 1. The engine driver exited before a terminal safe output was recorded.

dependency failed to start: container awf-cli-proxy exited (1)
Error: AWF firewall failed to start: awf-cli-proxy could not connect to the external DIFC proxy (or exited before establishing a connection). Failing fast to avoid repeated in-agent retries. The agent was never invoked. See awf-cli-proxy container logs above for details.

Debug the agentic workflow failure using https://raw.githubusercontent.com/github/gh-aw/main/debug.md

The failed workflow run is at https://github.com/githubnext/rig/actions/runs/37682383699