Avoid redacted crosslinks in docs review suggestions (#191)

* Avoid redacted crosslinks in docs review suggestions

Configure the docs review workflow sanitizer for expected docs hosts and steer review suggestions away from apply-ready patches that include link targets safe outputs may rewrite.

Co-authored-by: GPT-5.5 <gpt-5.5@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

* Preserve existing gh-aw action pins

Keep the previous v0.79.3 action cache entries while adding the v0.79.6 setup pin needed by the regenerated docs review workflow.

Co-authored-by: GPT-5.5 <gpt-5.5@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

* Narrow crosslink suggestion guidance

Allow relative links in docs review suggestions while avoiding custom-protocol links and bare URLs outside the safe-output allowlist.

Co-authored-by: GPT-5.5 <gpt-5.5@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: GPT-5.5 <gpt-5.5@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 3 people

.github/workflows/gh-aw-docs-review.lock.yml

@@ -70,6 +70,10 @@ network:
     - "docs-v3-preview.elastic.dev"
 strict: false
 safe-outputs:
+  allowed-domains:
+    - www.elastic.co
+    - docs-v3-preview.elastic.dev
+    - github.com
   noop:
   add-comment:
     max: 1
@@ -453,6 +457,8 @@ For inline comments with concrete replacements:
 - keep the suggested replacement as small as possible while still fixing the issue, and
 - inspect the exact comment body before calling `create_pull_request_review_comment`, especially when using a suggestion block, to confirm it contains the literal replacement text you want GitHub to apply.
 
+Do not use a GitHub suggestion block when the replacement contains a custom-protocol link target such as `kibana://` or `docs-content://`. Also avoid suggestion blocks for bare URLs that are not covered by the safe-output allowlist. Relative links are OK in suggestion blocks. For unsafe link targets, explain the replacement in prose or quote only the affected link target in inline code.
+
 Treat low-priority nits differently:
 
 - avoid nits unless they are grounded in the pre-fetched Vale output or another explicit review rule in this workflow,