knowledge-librarian workflow now runs a fixed, reviewed in-repo script (bash .lokf/scripts/knowledge-librarian.sh) instead of an arbitrary command string from a repository variable, so changing what executes goes through code review rather than an unreviewed Settings edit.
knowledge-librarian workflow split into two jobs: the agent (third-party code) runs in a contents: read job with no persisted git credentials and hands its proposed change to a separate privileged job - which runs no agent code - as a patch artifact. Only that job holds contents: write / pull-requests: write, so a compromised agent cannot reach a write-scoped credential. Top-level workflow permissions now default to none.
knowledge-librarian.sh wrapper now parses AGENT_CLI into a quoted argv array (removing the unquoted expansion that word-split the value at the command position) and enforces the bundle boundary after the agent runs: it fails if the agent modified any path outside .lokf/knowledge/ (.lokf/feedback.md allowed), so the “edit only the bundle” contract is enforced, not merely requested.
Changed
Arm the scheduled librarian run with the KNOWLEDGE_LIBRARIAN_ENABLED repository variable set to true (replaces KNOWLEDGE_LIBRARIAN_CMD); AGENT_CLI is unchanged. Updated the lokf-sidecar templates, the dogfooded workflow, the wrapper-script header, and the lokf-sidecar/lokf-librarian automation docs to match.
