repo-memory: ignore disallowed files before artifact upload and push

[dsyme]

Failed job

Failed job: https://github.com/github/github-automation/actions/runs/33473894161/job/99754695107

Observed sequence

• Configuration had ALLOWED_EXTENSIONS [".json"] and an empty FILE_GLOB_FILTER.
• The agent job step Validate repo-memory domain content (default) succeeded, and custom validation reported ci-perf notes.json conforms to schema.
• Upload repo-memory artifact (default) then reported 2 files uploaded.
• Downstream Push repo-memory changes (default) kept notes.json (42 bytes) and notes.json.new (0 bytes), then failed because .new was not allowed.

Root cause

In the current gh-aw source, generateRepoMemoryArtifactUpload does not pass ALLOWED_EXTENSIONS to validate_memory_step.cjs, so its final validation skips extension checks. push_repo_memory.cjs validates the entire artifact directory after collecting candidate files, producing a late failure.

The safe-output push_repo_memory preflight validates size/count/diff but does not enforce allowed extensions, so validation behavior is inconsistent across stages.

Proposed behavior

Treat allowed extensions and file-glob as persistence filters. Log and ignore files that are not eligible before artifact upload, count/size/custom validation, and downstream copy/push. Never commit a disallowed file.

If strict rejection is intentionally preferred, at minimum apply identical validation in preflight and final agent-job validation so the failure occurs before artifact upload rather than in downstream push.

Acceptance criteria

1. With allowed-extensions [.json], notes.json is persisted while notes.json.new is logged and ignored.
2. Filtered files do not count toward max-file-count, max-file-size, patch-size, or custom validation.
3. Agent-side preflight/final validation and downstream push use the same effective file set.
4. If no eligible files changed, push_repo_memory exits successfully as a no-op.
5. Add regression tests for extension filtering and interaction with file-glob.

Duplicate check

Duplicate search found no matching open or closed issue.