[docs] Update documentation for features from 2025-10-28

[github-actions]

Documentation Updates - 2025-10-28

This PR updates the documentation based on features merged in the last 24 hours.

Features Documented

1. --zizmor flag for compile command (from Add --zizmor flag to compile command for security scanning #2639)

   • Added documentation for the new security scanning flag
   • Explained zizmor integration and output behavior

2. Strict mode + zizmor enforcement (from Add strict mode enforcement for zizmor security findings #2652)

   • Documented that strict mode treats zizmor findings as compilation errors
   • Added usage examples for --strict --zizmor combination

3. stop-after time unit clarification (from Reject minute units in stop-after relative time deltas #2611)

   • Clarified that minute-only units (e.g., +30m) are not allowed
   • Updated examples to show proper time unit combinations

4. MCP logs max_tokens parameter (from Add token-based output guardrail to MCP server logs command with configurable limit #2616)

   • Documented the new configurable token limit (default: 12,000 tokens)
   • Explained output guardrail behavior with schema and jq suggestions
   • Added usage example for customizing the limit

Changes Made

• Updated docs/src/content/docs/tools/cli.md to document --zizmor flag and strict mode behavior
• Updated docs/src/content/docs/reference/triggers.md to clarify stop-after time unit requirements
• Updated docs/src/content/docs/reference/frontmatter-full.md to add note about minute-only units
• Updated docs/src/content/docs/tools/mcp-server.md to document max_tokens parameter and output guardrail

Merged PRs Referenced

• Add --zizmor flag to compile command for security scanning #2639 - Add --zizmor flag to compile command for security scanning
• Add strict mode enforcement for zizmor security findings #2652 - Add strict mode enforcement for zizmor security findings
• Reject minute units in stop-after relative time deltas #2611 - Reject minute units in stop-after relative time deltas
• Add token-based output guardrail to MCP server logs command with configurable limit #2616 - Add token-based output guardrail to MCP server logs command with configurable limit

Additional Notes

• The toolsets rename (from Rename toolset to toolsets in GitHub tool configuration #2648) was already documented in docs: Recommend GitHub MCP Server toolsets over individual allowed tools #2647
• Internal changes and security fixes (Fix template injection vulnerability in git config user.name #2640, Always emit persist-credentials: false with actions/checkout #2641, Remove github.actor and github.workflow from allowed expressions #2642, Set detection job to explicit empty permissions #2644, Fix push-to-pull-request-branch error handling and log truncation issues #2656) did not require user-facing documentation updates
• All documentation follows the Diátaxis framework guidelines

🤖 Generated with Claude Code

AI generated by Daily Documentation Updater

---

Note

This was originally intended as a pull request, but the git push operation failed.

Workflow Run: View run details and download patch artifact

The patch file is available as an artifact (aw.patch) in the workflow run linked above.
To apply the patch locally:

# Download the artifact from the workflow run https://github.com/githubnext/gh-aw/actions/runs/18865737760
# (Use GitHub MCP tools if gh CLI is not available)
gh run download 18865737760 -n aw.patch
# Apply the patch
git am aw.patch

Show patch preview (119 of 119 lines)

From cda1a903695c4e4e2db4d0d115f3a1a422633772 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Tue, 28 Oct 2025 06:10:15 +0000
Subject: [PATCH] [docs] Update documentation for features from 2025-10-27
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit updates documentation based on features merged in the last 24 hours.

Updates include:
- Document --zizmor flag for security scanning in compile command
- Document strict mode enforcement with zizmor findings
- Clarify stop-after time units (minute-only units not allowed)
- Document max_tokens parameter for MCP logs output guardrail

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../docs/reference/frontmatter-full.md        |  3 ++-
 docs/src/content/docs/reference/triggers.md   |  2 +-
 docs/src/content/docs/tools/cli.md            | 10 ++++++++-
 docs/src/content/docs/tools/mcp-server.md     | 22 +++++++++++++++++++
 4 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/docs/src/content/docs/reference/frontmatter-full.md b/docs/src/content/docs/reference/frontmatter-full.md
index 624fe14..9895876 100644
--- a/docs/src/content/docs/reference/frontmatter-full.md
+++ b/docs/src/content/docs/reference/frontmatter-full.md
@@ -526,7 +526,8 @@ on:
 
   # Time when workflow should stop running. Supports multiple formats: absolute
   # dates (YYYY-MM-DD HH:MM:SS, June 1 2025, 1st June 2025, 06/01/2025, etc.) or
-  # relative time deltas (+25h, +3d, +1d12h30m)
+  # relative time deltas (+25h, +3d, +1d12h30m). Note: Minute-only units (e.g., +30m)
+  # are not allowed; use hours instead (e.g., +1h).
   # (optional)
   stop-after: "example-value"
 
diff --git a/docs/src/content/docs/reference/triggers.md b/docs/src/content/docs/reference/triggers.md
index 95339b5..9cab951 100644
--- a/docs/src/content/docs/reference/triggers.md
+++ b/docs/src/
... (truncated)