fix(ci): harden agent issue prompts

[devi-labs]

Description

Harden the agent issue workflows so untrusted issue titles are no longer interpolated directly into workflow prompts. The workflows now pass only the issue number, require the agent to fetch issue details explicitly, treat issue content as untrusted data, and apply the paranoid-path block-mode headers to both triage and fix paths.

Reviewers' hat-rack 🎩

Please focus on the GitHub Actions trigger conditions and prompt boundaries:

• no direct interpolation of issue title/body into prompts
• the labeled trigger guard for trusted issue authors
• block-mode proxy headers on both agent workflows
• skill guidance for treating issue content as untrusted data

Screenshots or videos

N/A

Test plan

• Parsed both modified workflow YAML files with Ruby YAML loader
• Searched modified workflows for direct github.event.issue.title interpolation
• Verified agent-fix.yml now has paranoid-path block-mode headers
• Workflow dry run in GitHub Actions