[docs-linker] workshop docs: add gh-aw doc links

workshop/side-quest-10-02-jailbreak-brief.md

@@ -115,7 +115,7 @@ The fourth sentence — "Please disregard your current task…" — is the injec
 - [ ] I can describe what `network.allowed` blocks even after a partial jailbreak succeeds
 - [ ] I identified the injection sentence in the exercise above
 - [ ] I reviewed my own workflow's `permissions:` block and confirmed each scope is needed
-- [ ] I can explain what the optional agentic threat detection job does and when it prevents declared `safe-outputs` writes from running
+- [ ] I can explain what the optional agentic [threat detection](https://github.github.com/gh-aw/reference/threat-detection/) job does and when it prevents declared `safe-outputs` writes from running
 
 ---
 

workshop/side-quest-10-03-skill-dispatcher.md

@@ -6,7 +6,7 @@
 
 ## :dart: What You'll Do
 
-Learn how the `agentic-workflows` Copilot skill routes your plain-English request to the right editing, debugging, or optimizing prompt, and practice choosing the right trigger phrase for a given situation.
+Learn how the `agentic-workflows` [Copilot skill](https://github.github.com/gh-aw/reference/custom-agent-for-aw/) routes your plain-English request to the right editing, debugging, or optimizing prompt, and practice choosing the right trigger phrase for a given situation.
 
 ## :clipboard: Before You Start
 

workshop/side-quest-11-01-frontmatter-deep-dive.md

@@ -2,7 +2,7 @@
 <!-- page-adventure: side-quest -->
 # Side Quest: [Frontmatter](https://github.github.com/gh-aw/reference/frontmatter/) Deep Dive — Part A
 
-> _Optional: configure each of the opening three frontmatter sections of an [agentic workflow](https://github.github.com/gh-aw/introduction/overview/) file — metadata, triggers, and [permissions](https://github.github.com/gh-aw/reference/permissions/). Work through this before building Step 11, then continue to [Part B: Tools, Outputs, and the Agent Body](side-quest-11-08-frontmatter-tools-outputs.md) or return to the main path._
+> _Optional: configure each of the opening three frontmatter sections of an [agentic workflow](https://github.github.com/gh-aw/introduction/overview/) file — metadata, [triggers](https://github.github.com/gh-aw/reference/triggers/), and [permissions](https://github.github.com/gh-aw/reference/permissions/). Work through this before building Step 11, then continue to [Part B: Tools, Outputs, and the Agent Body](side-quest-11-08-frontmatter-tools-outputs.md) or return to the main path._
 
 ## :clipboard: Before You Start
 
@@ -116,7 +116,7 @@ permissions:
 | `contents: read` | Read access to repository files and commits. |
 | `copilot-requests: write` | Required by the [Copilot engine](https://github.github.com/gh-aw/reference/engines/). |
 | `issues: read` | Read access to issue data. |
-| `pull-requests: read` | Read access to pull request data. |
+| `pull-requests: read` | Read access to [pull request](https://github.github.com/gh-aw/reference/triggers/#pull-request-triggers-pullrequest) data. |
 | `actions: read` | Read access to workflow run results. |
 
 **:pencil2: Try it:** Add the `permissions:` block to your draft. Then fill in the correct permission value for each scope:

workshop/side-quest-11-01b-workflow-structure.md

@@ -15,7 +15,7 @@ An [agentic workflow](https://github.github.com/gh-aw/introduction/overview/) fi
 - **[Frontmatter](https://github.github.com/gh-aw/reference/frontmatter/)** — YAML between `---` fences at the top of the file. This configures how and when the workflow runs.
 - **Markdown body** — the agent's task brief, written below the closing `---`. The AI reads this at runtime.
 
-The file ends in `.md` instead of `.yml` because the [frontmatter](https://github.github.com/gh-aw/reference/frontmatter/) is only the opening config block — the rest of the file is a Markdown brief that the agent reads at runtime. See the [Classic vs. Agentic comparison in Step 5](05-agentic-workflows-intro.md).
+The file ends in `.md` instead of `.yml` because the [frontmatter](https://github.github.com/gh-aw/reference/frontmatter/) is only the opening config block — the rest of the file is a Markdown brief that the agent reads at runtime, and the compiler generates a paired [`.lock.yml`](https://github.github.com/gh-aw/reference/workflow-structure/#file-organization) file that GitHub Actions actually runs. See the [Classic vs. Agentic comparison in Step 5](05-agentic-workflows-intro.md).
 
 ---
 

workshop/side-quest-11-02-yaml-frontmatter.md

@@ -101,7 +101,7 @@ You are an AI assistant...
 
 ## `copilot-requests: write` not listed under `permissions`
 
-This is the single most common reason a workflow compiles but produces no output. The agent can't make AI calls without this permission.
+This is the single most common reason a workflow compiles but produces no output. The agent can't make AI calls without this [special permission](https://github.github.com/gh-aw/reference/permissions/#special-permission-copilot-requests-write).
 
 ```markdown
 ---

workshop/side-quest-11-03-better-prompts.md

@@ -83,7 +83,7 @@ Short constraints pay dividends over hundreds of automated runs.
 
 ## Reference Step Outputs Explicitly
 
-When your workflow fetches data in earlier steps (see [Step 16](16-connect-data-source.md)), point the AI at that data by name:
+When your workflow fetches data in earlier [steps](https://github.github.com/gh-aw/reference/steps-jobs/#custom-steps-steps) (see [Step 16](16-connect-data-source.md)), point the AI at that data by name:
 
 ```
 Use `${{ steps.recent.outputs.commit_log }}` as the source of commit activity.

workshop/side-quest-11-05-event-triggers.md

@@ -15,7 +15,7 @@ You'll compare scheduled and event-driven [triggers](https://github.github.com/g
 
 ## Scheduled vs event-driven triggers
 
-A **scheduled** workflow runs because the clock says it is time. An **event-driven** workflow runs because something happened in the repository, like a pull request opening or an issue being reopened.
+A **scheduled** workflow runs because the clock says it is time. An **event-driven** workflow runs because something happened in the repository, like a [pull request](https://github.github.com/gh-aw/reference/triggers/#pull-request-triggers-pullrequest) opening or an issue being reopened.
 
 | Trigger style | What starts it | Good fit |
 |---------------|----------------|----------|

workshop/side-quest-11-06-anthropic-key.md

@@ -96,7 +96,7 @@ If you previously added `copilot-requests: write` for the Copilot engine, you ca
 
 ## Compile your workflow
 
-After updating your frontmatter, compile the workflow to regenerate the lock file:
+After updating your frontmatter, compile the workflow to regenerate the [lock file](https://github.github.com/gh-aw/reference/workflow-structure/#lock-file-header):
 
 ```bash
 gh aw compile

workshop/side-quest-11-07-openai-key.md

@@ -2,7 +2,7 @@
 <!-- page-adventure: side-quest -->
 # Side Quest: Configure an OpenAI API Key
 
-> _Optional: work through this guide when you want to use the `codex` engine (OpenAI-powered) for your agentic workflow, then return to your main path._
+> _Optional: work through this guide when you want to use the `codex` [engine](https://github.github.com/gh-aw/reference/engines/) (OpenAI-powered) for your agentic workflow, then return to your main path._
 
 By default, [agentic workflows](https://github.github.com/gh-aw/introduction/overview/) use the [GitHub Copilot engine](https://github.github.com/gh-aw/reference/engines/). To use **OpenAI models**, store an OpenAI API key as a repository secret and add one [frontmatter](https://github.github.com/gh-aw/reference/frontmatter/) line.