[plan] Update compiler to emit lock-issue step in activation job

[github-actions]

Objective

Modify the workflow compiler to emit a step that locks the issue when lock-for-agent: true is set in the frontmatter.

Context

Depends on #6202, #aw_def456ghi789 being completed. The compiler needs to check the frontmatter and conditionally add the locking step to the activation job.

Approach

1. In pkg/workflow/compiler.go or the activation job builder, check if on.issue.lock-for-agent is true
2. If enabled, emit a step in the activation job that runs lock-issue.cjs script
3. Position the step early in the activation job (before the agent runs)
4. Use the bundled script reference (similar to how other embedded scripts are used)
5. If reactions are enabled, update the reaction message to indicate the issue is locked
6. Test by compiling a workflow with lock-for-agent: true and verify the generated YAML

Files to Modify

• pkg/workflow/compiler.go or related activation job builder files
• Reaction message logic (if exists separately)
• Test compilation with sample workflow

Acceptance Criteria

• Compiler checks on.issue.lock-for-agent field from frontmatter
• When true, activation job includes lock-issue step
• Step executes before agent processing begins
• Reaction message includes lock notification when both features enabled
• Compiled workflow YAML includes the correct step structure
  Related to Locking of issues #6201

AI generated by Plan Command for #6201

[pelikhan]

Handle case where issue is already locked. In which case it should not be unlocked when the agent is done.