docs: document token-steering firewall, concurrency.queue, and ghes-artifact-compat feature flag

Add reference documentation for three user-facing surfaces merged in the
last 24h that had no prior documentation:

- firewall.effective-token-steering (#31796): budget-warning system
  message injection via AWF v0.25.44+
- concurrency.queue and features.group-concurrency-queue (#31764):
  queue:max behavior and opt-out for compiler-generated groups
- features.ghes-artifact-compat (#31664): per-workflow GHES artifact
  compatibility opt-in via frontmatter or GH_AW_FEATURES env var

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: github-actions[bot]

docs/src/content/docs/reference/concurrency.md

@@ -68,6 +68,28 @@ When set, the `safe_outputs` job uses `cancel-in-progress: false` — meaning qu
 
 See [Safe Outputs](/gh-aw/reference/safe-outputs/#safe-outputs-job-concurrency-concurrency-group) for details.
 
+## Queue Behavior (`queue`)
+
+GitHub Actions concurrency groups accept an optional `queue` field that controls how multiple pending runs in the same group are handled. The gh-aw compiler preserves this field in both top-level and per-engine concurrency blocks:
+
+| Value | Behavior |
+|---|---|
+| `single` (Actions default) | Only the latest pending run is kept; earlier pending runs are discarded. |
+| `max` | All pending runs queue and run in arrival order. |
+
+```yaml wrap
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  queue: max
+```
+
+Compiler-generated concurrency groups (agent, output, and conclusion jobs) emit `queue: max` by default so back-to-back triggers run sequentially rather than being dropped. Set `features.group-concurrency-queue: false` to omit `queue` from generated groups and revert to the Actions default:
+
+```yaml wrap
+features:
+  group-concurrency-queue: false
+```
+
 ## Conclusion Job Concurrency
 
 The `conclusion` job — which handles reporting and post-agent cleanup — automatically receives a workflow-specific concurrency group derived from the workflow filename:
@@ -77,9 +99,10 @@ conclusion:
   concurrency:
     group: "gh-aw-conclusion-my-workflow"
     cancel-in-progress: false
+    queue: max
 ```
 
-This prevents conclusion jobs from colliding when multiple agents run the same workflow concurrently. The group uses `cancel-in-progress: false` so queued conclusion runs complete in order rather than being discarded.
+This prevents conclusion jobs from colliding when multiple agents run the same workflow concurrently. The group uses `cancel-in-progress: false` so queued conclusion runs complete in order rather than being discarded, and `queue: max` preserves arrival order for queued runs (see [Queue Behavior](#queue-behavior-queue)).
 
 This concurrency group is set automatically during compilation and requires no manual configuration.
 

docs/src/content/docs/reference/enterprise-configuration.md

@@ -42,6 +42,17 @@ gh aw compile --ghes my-workflow.md
 > [!NOTE]
 > The `--ghes` flag only affects the current compilation. Use `aw.json` to apply GHES compatibility permanently across all workflows in the repository.
 
+#### Enable per workflow via `features`
+
+Set `features.ghes-artifact-compat: true` in workflow frontmatter to opt a single workflow into artifact-compat mode without changing the repository-wide setting:
+
+```aw wrap
+features:
+  ghes-artifact-compat: true
+```
+
+Equivalently, set the `GH_AW_FEATURES=ghes-artifact-compat` environment variable when invoking `gh aw compile`. When the flag is active the compiler pins `actions/upload-artifact@v3.2.2` and `actions/download-artifact@v3.1.0`; compilation fails fast if the required v3 pin is missing rather than silently emitting an incompatible v4+ reference.
+
 ## GitHub Enterprise Server CLI Setup
 
 For `gh` CLI configuration, host authentication, and `GH_HOST` setup on GHES, see [GitHub Enterprise Server Support](/gh-aw/setup/cli/#github-enterprise-server-support) in the CLI reference.

docs/src/content/docs/reference/network.md

@@ -264,6 +264,18 @@ SSL bump intercepts and decrypts HTTPS traffic as a man-in-the-middle — only e
 
 Use SSL bump when you need to allow specific API endpoints while blocking others on the same domain. See the [Sandbox Configuration](/gh-aw/reference/sandbox/) documentation for detailed AWF configuration options.
 
+### Effective Token Steering
+
+Set `firewall.effective-token-steering: true` to opt the AWF API proxy into injecting budget-warning system messages as the run approaches its effective-token budget. Warnings fire at 80%, 90%, 95%, and 99% of the configured `max-effective-tokens`, giving the agent a chance to wrap up work before the budget is exhausted.
+
+```yaml wrap
+firewall:
+  effective-token-steering: true
+max-effective-tokens: 5000000
+```
+
+The compiler maps this field to `apiProxy.enableTokenSteering` in the generated AWF configuration. Token steering requires AWF `v0.25.44` or later; for older pinned versions the setting is silently dropped at compile time. See [Max Effective Tokens](/gh-aw/reference/glossary/#max-effective-tokens-max-effective-tokens) for budget configuration.
+
 ### Disabling the Firewall
 
 The firewall is always enabled via the default `sandbox.agent: awf` configuration: