fix(workflows): exempt catalog automation from PR-count confirmation

.github/workflows/add-community-bundle.md

@@ -276,6 +276,11 @@ repository README remains the source for the actual URLs.
 
 Create one draft pull request.
 
+This repository-owned gh-aw maintenance workflow does not perform the contributor
+open-PR count check or request confirmation. After successful validation and
+allowed catalog/docs file updates, emit the configured draft `create_pull_request`
+safe output regardless of the submitter's or filing account's open PR count.
+
 - New entry branch:
   `community/${{ github.event.issue.number }}-add-<bundle-id>-bundle`
 - Update branch:

.github/workflows/add-community-extension.md

@@ -257,6 +257,11 @@ Find the existing row and update any changed fields in-place.
 
 Create a pull request with the changes. Use this branch naming convention:
 
+This repository-owned gh-aw maintenance workflow does not perform the contributor
+open-PR count check or request confirmation. After successful validation and
+allowed catalog/docs file updates, emit the configured draft `create_pull_request`
+safe output regardless of the submitter's or filing account's open PR count.
+
 - **New extension:** `add-<extension-id>-extension`
 - **Update:** `update-<extension-id>-extension`
 

.github/workflows/add-community-preset.md

@@ -310,6 +310,11 @@ Find the existing row and update any changed fields in-place.
 
 Create a pull request with the changes. Use this branch naming convention:
 
+This repository-owned gh-aw maintenance workflow does not perform the contributor
+open-PR count check or request confirmation. After successful validation and
+allowed catalog/docs file updates, emit the configured draft `create_pull_request`
+safe output regardless of the submitter's or filing account's open PR count.
+
 - **New preset:** `add-<preset-id>-preset`
 - **Update:** `update-<preset-id>-preset`
 

tests/test_github_workflows.py

@@ -55,6 +55,12 @@
         "Do not modify any other files",
     ),
 )
+REPOSITORY_OWNED_DRAFT_PR_EXEMPTION = (
+    "This repository-owned gh-aw maintenance workflow does not perform the contributor "
+    "open-PR count check or request confirmation. After successful validation and "
+    "allowed catalog/docs file updates, emit the configured draft `create_pull_request` "
+    "safe output regardless of the submitter's or filing account's open PR count."
+)
 
 
 def _publish_workflow_steps() -> dict[str, dict[str, object]]:
@@ -105,6 +111,19 @@ def _create_pull_request_allowed_files(source_text: str) -> list[str]:
     ]
 
 
+def _compiled_create_pull_request_config(compiled_text: str) -> dict[str, object]:
+    compiled = yaml.safe_load(compiled_text)
+    config_step = _workflow_step(
+        compiled["jobs"]["agent"]["steps"], "Generate Safe Outputs Config"
+    )
+    config = next(
+        line.strip()
+        for line in config_step["run"].splitlines()
+        if line.lstrip().startswith('{"')
+    )
+    return json.loads(config)["create_pull_request"]
+
+
 def _workflow_frontmatter(source_text: str) -> dict[str, object]:
     _, frontmatter, _ = source_text.split("---", maxsplit=2)
     return yaml.safe_load(frontmatter)
@@ -319,6 +338,29 @@ def test_community_submission_automation_is_wired_to_allowed_files():
         assert label in assignment_text
 
 
+def test_community_submission_draft_pr_exemption_is_runtime_wired():
+    """Repository-owned catalog maintenance bypasses contributor PR-count policy."""
+    for workflow, _, catalog_file, docs_file, _ in COMMUNITY_SUBMISSION_WORKFLOWS:
+        source = WORKFLOWS_DIR / f"add-community-{workflow}.md"
+        compiled = WORKFLOWS_DIR / f"add-community-{workflow}.lock.yml"
+        source_text = source.read_text(encoding="utf-8")
+        compiled_text = compiled.read_text(encoding="utf-8")
+
+        assert REPOSITORY_OWNED_DRAFT_PR_EXEMPTION in " ".join(source_text.split())
+        assert (
+            f"{{{{#runtime-import .github/workflows/add-community-{workflow}.md}}}}"
+            in compiled_text
+        )
+
+        source_create_pr = _frontmatter(source_text)["safe-outputs"][
+            "create-pull-request"
+        ]
+        compiled_create_pr = _compiled_create_pull_request_config(compiled_text)
+        assert source_create_pr["draft"] is True
+        assert compiled_create_pr["draft"] is True
+        assert compiled_create_pr["allowed_files"] == [catalog_file, docs_file]
+
+
 # Full clauses from the catalog download-URL checks (issue #4185). Assert the
 # complete sentences so independent keywords cannot drift apart.
 _CATALOG_DOWNLOAD_URL_CLAUSES = (