workflows: Fix broken protected-files override expression

The && ternary idiom (cond && 'allowed' || 'request_review') broke
drafter.lock.yml and fix.lock.yml outright: gh-aw's compiler
JSON-encodes this policy string with Go's default HTML-escaping,
turning the literal && into \u0026\u0026 inside the heredoc-embedded
config blob. GitHub Actions' expression parser can't parse that,
so the whole workflow file was rejected as invalid on push -- see
https://github.com/cgwalters/gh-aw-fullsend-mini/actions/runs/30547055376
(zero jobs even attempted; both drafter.md and fix.md were
effectively disabled since the merge of #20).

Switch to GitHub Actions' case() function, which expresses the same
if/else without &, <, or > -- the only characters Go's json.Marshal
HTML-escapes by default -- so it survives gh-aw's config serialization
intact.

Assisted-by: https://github.com/cgwalters/cgwalters#llms

Author: cgwalters

.github/workflows/drafter.lock.yml

@@ -38,7 +38,13 @@ safe-outputs:
     # this specific run to edit them without that gate. This must not become
     # the default — see "Letting the agent edit protected files" in README.md.
     protected-files:
-      policy: ${{ contains(github.event.issue.labels.*.name, 'agent/workflow-edits-allowed') && 'allowed' || 'request_review' }}
+      # case(), not "cond && 'allowed' || 'request_review'": gh-aw's compiler
+      # JSON-encodes this string with Go's default HTML-escaping, which turns
+      # a literal && into \u0026\u0026 and produces an expression GitHub
+      # Actions can't parse (silently breaking the whole workflow file at
+      # push time, no job even attempts to run). case() has no &, <, or >,
+      # so it survives that encoding intact.
+      policy: ${{ case(contains(github.event.issue.labels.*.name, 'agent/workflow-edits-allowed'), 'allowed', 'request_review') }}
 
 timeout-minutes: 15
 ---