docs(prompts): add missing permissions-required to create-workflow field list

[github-actions]

Agent Documentation Update

Findings

Area	Issue	File(s)
accuracy	permissions-required is a real, documented FrontMatter field (src/compile/types.rs, serde rename permissions-required; described in docs/imports.md#permissions-required and docs/front-matter.md) used to declare abstract read/write capability requirements for reusable components, but the create-workflow authoring prompt's optional front-matter field checklist omitted it. Since this prompt drives the ado-aw agent's workflow-authoring output, an agent following it would never know to emit permissions-required when scaffolding a reusable component, silently under-specifying its abstract capability contract.	prompts/create-ado-agentic-workflow.md

Applied Fixes

• Added permissions-required to the optional front-matter key list in prompts/create-ado-agentic-workflow.md step 2 ("Build Front Matter"), alongside the existing permissions entry.

Notes

Verified permissions-required against src/compile/types.rs (FrontMatter::permissions_required: PermissionsRequired, #[serde(rename = "permissions-required")]) and its documented semantics in docs/imports.md ("## permissions-required" section) and docs/front-matter.md. Checked open PRs via GitHub search first (is:pr is:open repo:githubnext/ado-aw permissions-required prompts create-ado-agentic-workflow) — no overlapping PR found. Other drift candidates found during the audit (e.g. container_runtime.rs missing from the AGENTS.md architecture tree, ecosystem-domain list drift, ir.md staleness) are already covered by multiple existing open PRs, so this run intentionally left those untouched to avoid duplicate work.

---

Created by the agent-documentation maintainer workflow.

Generated by Agent Documentation Maintainer · auto · 100.8 AIC · ⌖ 8 AIC · ⊞ 12.4K · ◷

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.