Fix state-machine workflow: add protected-files: allowed for .github/docs/ output

The agentic-state-machine workflow has been failing since PR #19721 moved
the output to .github/docs/state-machine.md. Files under .github/ are
treated as protected by gh-aw (agent instruction files, security config).

The allowed-files config permits WHICH files can be modified but does not
override the built-in protected-files blocking. Adding protected-files:
allowed explicitly opts in, which is safe since allowed-files already
restricts writes to .github/docs/** only.

Fixes #19739

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: T-Gro

.github/workflows/agentic-state-machine.lock.yml

@@ -29,6 +29,7 @@ safe-outputs:
     draft: false
     max: 1
     allowed-files: [".github/docs/**"]
+    protected-files: allowed
 ---
 
 # Agentic State Machine — Diagram Generator