Dogfood GitHub-powered doc automations

[an1va]

Summary

• let Automations select active standard workspace integrations, including the new GitHub App connection, alongside personal/MCP sources
• let automate action:"create_context" bind the exact same least-privilege source ids, so the context can be tested directly before it runs on a clock
• project bounded workflow loop policy into the visible linked graph during derive workflow sync, preventing a Ready workflow from publishing with missing-policy advisories

Scenario

The first production dogfood is one internal living doc: read merged PRs from derive-to/derive, update the same weekly brief with cited changes, and publish nothing on a no-change window.

Reviewable scenario + native Ready Preview:
https://derive.to/artifacts/weekly-github-derive-doc-update-dojve0ul

The scenario explicitly forbids PATs, repository mirroring, collection ingest, unauthenticated scraping, GitHub writes, and unbounded repair.

Verification

• pnpm verify — 33/33 guardrails, all typechecks, 2,633 passing tests; existing skips unchanged
• focused Playwright smoke — standard GitHub workspace connection appears in the real Automation source picker and remains selected
• published the scenario to the Derive production workspace and verified its native workflow view reports Ready to run, 3 agent steps, no human pauses, one bounded loop, and the expected forbidden actions

Production dogfood status

Automate is enabled and there are no existing automations in the Derive workspace. GitHub is not installed there yet. Installing the App for derive-to/derive, creating the context/target/automation, and attaching the first run receipt will finish this PR's live proof after explicit install confirmation.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Preview

https://derive-pr-809.derive-to.workers.dev

Deployed from 89e2b54 as derive-pr-809.

It shares production's database — sign in with your real account, and treat anything you change here as changed for real. It has no routes, no cron, no queue consumer and no OG renderer, so it cannot serve derive.to, run scheduled work, or write images onto real artifacts.

Unlike production it serves artifact HTML on its own origin (that is what makes frame-side changes visible here). Storage is still sandboxed away, but untrusted HTML and the sign-in form share a hostname — treat this URL as you would any link: don't type a password into it because a page asked you to.