Block advisory-affected gh-aw releases (#58029)

Author: Copilot

.github/aw/compat.json

@@ -1,6 +1,30 @@
 {
   "$schema": "./compat.schema.json",
-  "blockedVersions": [],
+  "blockedVersions": [
+    "v0.82.8",
+    "v0.82.9",
+    "v0.82.10",
+    "v0.82.11",
+    "v0.82.12",
+    "v0.82.13",
+    "v0.82.14",
+    "v0.82.15",
+    "v0.83.0",
+    "v0.83.1",
+    "v0.83.2",
+    "v0.83.3",
+    "v0.83.4",
+    "v0.83.5",
+    "v0.84.0",
+    "v0.84.1",
+    "v0.84.2",
+    "v0.84.3",
+    "v0.84.4",
+    "v0.85.0",
+    "v0.85.1",
+    "v0.85.2",
+    "v0.85.3"
+  ],
   "minimumVersion": "v0.65.3",
   "minRecommendedVersion": "v0.65.3",
   "agent-compat-v1": {

.github/aw/compat.md

@@ -0,0 +1,32 @@
+# Blocked gh-aw versions
+
+The following releases are blocked by `.github/aw/compat.json` and fail during
+workflow activation.
+
+| Versions | Reason |
+| --- | --- |
+| `v0.82.8` through `v0.85.3` | Affected by [GHSA-8h78-hpm7-29gg](https://github.com/github/gh-aw/security/advisories/GHSA-8h78-hpm7-29gg). `v0.85.4` is the first unaffected release. |
+
+## Remediation
+
+Upgrade to [`v0.85.4`](https://github.com/github/gh-aw/releases/tag/v0.85.4) or
+later, verify the installed version, then regenerate and review the repository's
+compiled workflows:
+
+```bash
+gh extension upgrade gh-aw
+gh aw version
+gh aw upgrade
+git diff -- .github/workflows
+```
+
+Confirm that `gh aw version` reports `v0.85.4` or later and commit the regenerated
+`.lock.yml` files. Blocking the affected compiler versions prevents their
+workflows from activating but does not regenerate existing workflow artifacts.
+See [Upgrading Workflows](https://github.com/github/gh-aw/blob/main/docs/src/content/docs/guides/working-with-workflows.mdx#upgrading-workflows)
+for the supported upgrade process.
+
+## Temporary mitigations
+
+No advisory-supported temporary mitigation could be verified. Upgrade and
+regenerate compiled workflows as described above.