[docs] Update documentation for features from 2026-05-13 (#31928)

* docs: document token-steering firewall, concurrency.queue, and ghes-artifact-compat feature flag

Add reference documentation for three user-facing surfaces merged in the
last 24h that had no prior documentation:

- firewall.effective-token-steering (#31796): budget-warning system
  message injection via AWF v0.25.44+
- concurrency.queue and features.group-concurrency-queue (#31764):
  queue:max behavior and opt-out for compiler-generated groups
- features.ghes-artifact-compat (#31664): per-workflow GHES artifact
  compatibility opt-in via frontmatter or GH_AW_FEATURES env var

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs: add tip pointing to --ghes and aw.json options in per-workflow section

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* docs: remove features.ghes-artifact-compat per-workflow section (feature does not exist)

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>

Author: 4 people

docs/src/content/docs/reference/concurrency.md

@@ -68,6 +68,28 @@ When set, the `safe_outputs` job uses `cancel-in-progress: false` — meaning qu
 
 See [Safe Outputs](/gh-aw/reference/safe-outputs/#safe-outputs-job-concurrency-concurrency-group) for details.
 
+## Queue Behavior (`queue`)
+
+GitHub Actions concurrency groups accept an optional `queue` field that controls how multiple pending runs in the same group are handled. The gh-aw compiler preserves this field in both top-level and per-engine concurrency blocks:
+
+| Value | Behavior |
+|---|---|
+| `single` (Actions default) | Only the latest pending run is kept; earlier pending runs are discarded. |
+| `max` | All pending runs queue and run in arrival order. |
+
+```yaml wrap
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  queue: max
+```
+
+Compiler-generated concurrency groups (agent, output, and conclusion jobs) emit `queue: max` by default so back-to-back triggers run sequentially rather than being dropped. Set `features.group-concurrency-queue: false` to omit `queue` from generated groups and revert to the Actions default:
+
+```yaml wrap
+features:
+  group-concurrency-queue: false
+```
+
 ## Conclusion Job Concurrency
 
 The `conclusion` job — which handles reporting and post-agent cleanup — automatically receives a workflow-specific concurrency group derived from the workflow filename:
@@ -77,9 +99,10 @@ conclusion:
   concurrency:
     group: "gh-aw-conclusion-my-workflow"
     cancel-in-progress: false
+    queue: max
 ```
 
-This prevents conclusion jobs from colliding when multiple agents run the same workflow concurrently. The group uses `cancel-in-progress: false` so queued conclusion runs complete in order rather than being discarded.
+This prevents conclusion jobs from colliding when multiple agents run the same workflow concurrently. The group uses `cancel-in-progress: false` so queued conclusion runs complete in order rather than being discarded, and `queue: max` preserves arrival order for queued runs (see [Queue Behavior](#queue-behavior-queue)).
 
 This concurrency group is set automatically during compilation and requires no manual configuration.
 

docs/src/content/docs/reference/network.md

@@ -264,6 +264,18 @@ SSL bump intercepts and decrypts HTTPS traffic as a man-in-the-middle — only e
 
 Use SSL bump when you need to allow specific API endpoints while blocking others on the same domain. See the [Sandbox Configuration](/gh-aw/reference/sandbox/) documentation for detailed AWF configuration options.
 
+### Effective Token Steering
+
+Set `firewall.effective-token-steering: true` to opt the AWF API proxy into injecting budget-warning system messages as the run approaches its effective-token budget. Warnings fire at 80%, 90%, 95%, and 99% of the configured `max-effective-tokens`, giving the agent a chance to wrap up work before the budget is exhausted.
+
+```yaml wrap
+firewall:
+  effective-token-steering: true
+max-effective-tokens: 5000000
+```
+
+The compiler maps this field to `apiProxy.enableTokenSteering` in the generated AWF configuration. Token steering requires AWF `v0.25.44` or later; for older pinned versions the setting is silently dropped at compile time. See [Max Effective Tokens](/gh-aw/reference/glossary/#max-effective-tokens-max-effective-tokens) for budget configuration.
+
 ### Disabling the Firewall
 
 The firewall is always enabled via the default `sandbox.agent: awf` configuration: