docs: address Copilot review feedback on PR #53

- Add `update-branch: false` to the update-pull-request YAML example so the documented parameter appears in the example block
- Note that fallback-as-pull-request=true causes pull-requests: write to be requested by default
- Remove undocumented `pull-request-repo` alternative from SEC-005 guidance; keep the `allowed-repos` path which is the only supported configuration

Author: zircote

skills/aw-author/references/production-gotchas.md

@@ -405,7 +405,7 @@ This was a cosmetic/log-noise issue only — workflow functionality was not impa
 When using `dispatch-workflow` or `call-workflow` safe-outputs that include a `target-repo` override, gh-aw enforces **SEC-005 allowlist validation** (as of 2026-04-20, PR #27242).
 
 **What this means:**
-- The target repository must appear in `allowed-repos` on the dispatch/call-workflow safe-output config block, **or** the workflow must use `pull-request-repo` configuration to permit the target.
+- The target repository must appear in `allowed-repos` on the `dispatch-workflow` or `call-workflow` safe-output config block.
 - Workflows that hard-code a `target-repo` without a matching `allowed-repos` entry will now fail at runtime with a validation error.
 
 **How to fix:**

skills/aw-author/references/safe-outputs.md

@@ -250,6 +250,7 @@ safe-outputs:
     body: true
     footer: true
     target: "triggering"
+    update-branch: false
     max: 1
 ```
 
@@ -311,7 +312,7 @@ safe-outputs:
 | `allowed-files` | list | — | Glob patterns forming a strict allowlist of files eligible for push |
 | `excluded-files` | list | — | Glob patterns for files to exclude via git pathspecs (stripped before commit) |
 | `patch-format` | string | `"am"` | Transport format: `"am"` (git format-patch) or `"bundle"` (git bundle, preserves merge topology) |
-| `fallback-as-pull-request` | boolean | `true` | Create fallback PR when push fails due to diverged/non-fast-forward branch; set `false` to disable |
+| `fallback-as-pull-request` | boolean | `true` | Create fallback PR when push fails due to diverged/non-fast-forward branch; because this defaults to `true`, `pull-requests: write` is requested by default; set `false` to disable |
 | `allow-workflows` | boolean | `false` | Add `workflows: write` to the App token (requires `safe-outputs.github-app`) |
 | `github-token-for-extra-empty-commit` | string | — | Token for empty commit to trigger CI (PAT or `"app"`) |
 | `max` | integer | `1` | Maximum pushes per run |