ci(workflows): bump gh-aw from 0.89.21 to 0.92.0 (#8330)

- Bump `gh-aw` from 0.89.21 to 0.92.0
- Switch from `pull_request_target` to `pull_request` for CI security
- Set `permissions.copilot-requests` to `none` for suppressing compilation info

.github/workflows/copilot-setup-steps.yml

@@ -31,6 +31,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Install gh-aw extension
-        uses: github/gh-aw-actions/setup-cli@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21
+        uses: github/gh-aw-actions/setup-cli@458b269006dcf88e3b5496b6fbecabe4b9a0f954 # v0.92.0
         with:
           version: v0.89.15

.github/workflows/pr-ai-slop-review.md

@@ -8,7 +8,7 @@ on:
   roles: all
   skip-roles: [admin, maintainer, write]
   skip-bots: [dependabot, renovate]
-  pull_request_target:
+  pull_request:
     # reopened is intentionally excluded: reopens carry no new implementation
     # evidence (the rerun-stability policy handles them), and a manual
     # workflow_dispatch remains available when a re-review is wanted.
@@ -26,6 +26,7 @@ max-daily-ai-credits: 5000
 permissions:
   issues: read
   pull-requests: read
+  copilot-requests: none
 
 pre-agent-steps:
   - name: Make Copilot quota exhaustion non-blocking