Document threat-detection-suppress and max-runs deprecation; fix stale check-for-updates link

docs/src/content/docs/reference/frontmatter.md

@@ -306,6 +306,19 @@ safe-outputs:
 
 When omitted, `report-failed-jobs` defaults to `true`.
 
+### Threat Detection Suppression (`threat-detection-suppress:`)
+
+Suppresses specific threat-detection diagnostic rules (`CTR-###` identifiers) that would otherwise block safe-output processing, with a required, auditable justification. Each entry must include a `rule` matching `CTR-###`, a non-empty `reason`, and an optional `expires` date in `YYYY-MM-DD` format; once `expires` has passed (UTC), the suppression is no longer active and the rule is enforced again.
+
+```yaml wrap
+threat-detection-suppress:
+  - rule: CTR-012
+    reason: "False positive on generated changelog entries; tracked in issue #123"
+    expires: "2026-12-31"
+```
+
+Compilation fails if any entry has an invalid `rule`, an empty `reason`, or a malformed `expires` date. See [Threat Detection](/gh-aw/reference/threat-detection/) for the full list of detection rules.
+
 ### Run Configuration (`run-name:`, `runs-on:`, `runs-on-slim:`, `timeout-minutes:`)
 
 Standard GitHub Actions properties:
@@ -351,6 +364,16 @@ Environment variables can be defined at multiple scopes (workflow, job, step, en
 >
 > Use engine-specific secret configuration instead of the `env:` section to pass secrets securely.
 
+### Turn Limit (`max-turns:`)
+
+Caps the number of chat iterations (model responses and tool calls) the AWF proxy allows for a single workflow run, across all supported engines. Defaults to `500` when omitted. Accepts an integer or a GitHub Actions expression that resolves to an integer at runtime.
+
+```yaml wrap
+max-turns: 20
+```
+
+The top-level `max-runs:` field is a **deprecated** alias for `max-turns:` and is only accepted as a fallback for backward compatibility. Migrate existing workflows with `gh aw fix`. See [Cost Management](/gh-aw/reference/cost-management/#cap-turns-per-run) for more details.
+
 ### AI Credits Guardrail (`max-ai-credits:`)
 
 Sets the AWF AI Credits budget used for cost enforcement. It is enabled by default and defaults to `1000` (`1k`) when omitted. Steering (budget-warning messages at 80%, 90%, 95%, and 99% of the budget) is enabled by default. Use plain integers or `K`/`M` suffixes such as `100000K` or `100M`. Set to a negative value to disable both budget enforcement and steering.

pkg/workflow/strict_mode_update_check_validation.go

@@ -8,7 +8,7 @@
 //   - In strict mode: setting check-for-updates: false raises a compilation error.
 //   - In non-strict mode: setting check-for-updates: false emits a warning.
 //
-// See: https://github.github.com/gh-aw/reference/check-for-updates/
+// See: https://github.github.com/gh-aw/reference/frontmatter/#check-for-updates
 package workflow
 
 import (