[instructions] Sync instruction files with release v0.87.0

.github/aw/safe-outputs-automation.md

@@ -141,6 +141,7 @@ description: Safe-output reference for workflow dispatch, code scanning, checks,
   safe-outputs:
     create-check-run:
       name: "Security Analysis"       # Optional: check run name (defaults to workflow name)
+      target: "triggering"            # Optional: "triggering" (default), "*" (any PR), or explicit PR number
       max: 1                          # Optional: max check runs per workflow run (default: 1)
       output:                         # Optional: static fallback values used when the agent omits the field
         title: "Pending analysis"     # Fallback title (max 256 chars)

.github/aw/safe-outputs-content.md

@@ -206,6 +206,7 @@ description: Safe-output reference for issue, discussion, comment, and pull requ
         - "main"
       max-patch-size: 2048            # Optional: per-output cap on git patch size in KB (overrides global; default: 4096 KB, max: 10240)
       max-patch-files: 50             # Optional: per-output cap on unique files in the patch (overrides global; default: 100)
+      stacked: true                   # Optional: allow PRs based on another PR branch from the same run (default: true; set false on GHES without stacked-PR support)
   ```
 
   **Dynamic Base Branch**: When `allowed-base-branches` is set, the agent can provide a `base` field in its output to override the default base branch for a single run — but only if the value matches one of the configured glob patterns. Without `allowed-base-branches`, only the static `base-branch:` is used. Accepts a literal array or a GitHub Actions expression resolving to a comma-separated list (e.g. `${{ inputs.allowed-base-branches }}`).

.github/aw/safe-outputs-management.md

@@ -27,6 +27,7 @@ description: Safe-output reference for update, label, milestone, project, releas
       body: true                      # Optional: enable body updates (default: true)
       operation: "replace"            # Optional: "replace" (default), "append", "prepend"
       update-branch: false            # Optional: update PR branch with latest base before updates (default: false)
+      update-branch.stacks: true      # Optional: allow stacked-PR stack-sync fallback when update-branch is unsupported (default: true)
       max: 1                          # Optional: max updates (default: 1)
       target: "*"                     # Optional: "triggering" (default), "*", or number
       target-repo: "owner/repo"       # Optional: cross-repository

.github/aw/syntax-agentic.md

@@ -327,6 +327,7 @@ description: Agentic workflow specific frontmatter fields for GitHub Agentic Wor
 
   - **`sandbox.agent.runtime`** (string) selects the sandbox security and topology profile: `docker` (default: rootless AWF with network isolation), `docker-sudo-iptables` (privileged AWF with legacy iptables networking and host/service access), `gvisor` (gVisor `runsc` kernel-level isolation), `docker-sbx` (KVM microVM), or `cloud-hypervisor` (preview KVM runtime). Omitting the field is equivalent to `docker`. gVisor and Docker sbx are incompatible with `runner.topology: arc-dind`; the compiler derives the privileged setup each runtime needs. Docker sbx also requires `DOCKER_PAT`/`DOCKER_USERNAME` secrets and a KVM-capable runner when runtime installation is enabled.
   - **`sandbox.agent.runtime-install`** (boolean) controls generated gVisor or Docker sbx provisioning and defaults to `true`. Set it to `false` only when the runner is pre-provisioned; Docker sbx credential refresh still runs. False wins when imported workflows merge this field. See [agent-runtime-instructions.md](agent-runtime-instructions.md) for requirements and troubleshooting.
+  - **`sandbox.agent.allow-host-ports`** (array of integers) additional host TCP ports the agent may connect to. Requires `runtime: docker-sudo-iptables`. Ports published by `services:` are reached via `--allow-host-service-ports` instead; use this only for host daemons not declared there. There is no `sandbox.agent.legacy-security` field — that mode was replaced by `runtime: docker-sudo-iptables`.
   - **Strict mode**: `sandbox.agent` blocks without an explicit `id: awf` are rejected in strict mode. Any non-nil, non-disabled agent config without `id`/`type` defaults to AWF at runtime.
 
 - **`tools:`** - Tool configuration for the coding agent (`github`, `agentic-workflows`, `edit`, `web-fetch`, `web-search`, `bash`, `playwright`, custom MCP server names, plus `timeout`/`startup-timeout`/`cli-proxy`). See [syntax-tools-imports.md](syntax-tools-imports.md#tool-configuration) for the full schema (GitHub `mode`/`toolsets`/integrity fields, bash allowlist decision rule, Playwright CLI mode).