Harden gh aw env update with strict input validation and non-mutating preview

[Copilot]

gh aw env had operational gaps for DevOps usage: updates could apply from typoed YAML keys silently, and there was no safe preview mode for automation or change review. This PR tightens update safety by validating input schema/values before mutation and adding an explicit dry-run path.

• Safety model improvements

  • Added --dry-run to gh aw env update to render the full update preview without applying variable changes.
  • Kept preview output unified so dry-run and real apply paths show the same effective change set.

• Strict config parsing

  • Switched update parsing to reject unknown YAML fields (prevents silent no-ops from misspelled keys).

• Input validation before mutation

  • Enforced integer validation for:
    • default_max_effective_tokens as a non-zero integer when set, preserving negative values as the existing signal to disable token steering / budget enforcement
    • default_max_turns as a positive integer
    • default_timeout_minutes as a positive integer
  • Enforced non-empty (non-whitespace) values for model fields:
    • default_detection_model
    • default_model_copilot
    • default_model_claude
    • default_model_codex

• Coverage and docs alignment

  • Extended env command unit tests for strict parsing, validation behavior, and new flag surface, including negative default_max_effective_tokens coverage.
  • Updated reference docs to describe --dry-run and the stricter input handling, including the preserved negative-value semantics for default_max_effective_tokens.

# Preview only (no variable mutations)
gh aw env update defaults.yml --scope org --org MY_ORG --dry-run
# Apply after preview
gh aw env update defaults.yml --scope org --org MY_ORG

[Copilot]

Pull request overview

Tightens gh aw env update by adding strict YAML parsing (rejecting unknown fields), pre-mutation validation for numeric and model fields, and a new --dry-run flag that renders the preview without mutating any variables. Preview rendering is factored into a shared helper so dry-run and the real apply path output the same change set.

Changes:

• Add --dry-run flag and short-circuit before confirmation/mutation in defaultsUpdateFromFile.
• Introduce defaultsParseFile (with DisallowUnknownField) and defaultsValidateFile (positive-int and non-empty checks); extract renderDefaultsUpdatePreview.
• Extend unit tests for the new flag, strict parsing, and validation; update cost-management docs.

Show a summary per file

File	Description
pkg/cli/env_command.go	Adds dry-run plumbing, strict YAML parsing, field validation, and shared preview renderer.
pkg/cli/env_command_test.go	Adds coverage for the dry-run flag, unknown-field rejection, and validator behavior.
docs/src/content/docs/reference/cost-management.md	Documents --dry-run, unknown-key rejection, and invalid-numeric handling.
.github/workflows/*.lock.yml (20 files)	Regenerated lock files adding GH_AW_COMMANDS to the safe-outputs job env and rotating heredoc markers; unrelated to the env-command changes described in the PR.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 24/24 changed files
• Comments generated: 1

[pelikhan]

@copilot merge main, recompile, review comments

[Copilot]

@copilot merge main, recompile, review comments

Done in 9a8abeb: merged main, recompiled workflows, and updated gh aw env update so default_max_effective_tokens accepts negative non-zero values again.