Autoloop template should exclude language-specific dev files from protected-files by default

Open workflows/autoloop.md and inspect the protected-files configuration for both create-pull-request and push-to-pull-request-branch. Add the listed language-specific development files to each exclude list while keeping the named documentation, ownership, and top-level dot-folder protections. Done means the template contains matching exclusions in both sections.

Problem

The default protected-files list in the autoloop workflow template blocks common dev files that autoloop programs legitimately need to modify:

• Go: go.mod, go.sum
• JS/TS: package.json, package-lock.json, bun.lockb, bunfig.toml, yarn.lock, pnpm-lock.yaml, tsconfig.json
• Python: requirements.txt, pyproject.toml, setup.py, setup.cfg, Pipfile, Pipfile.lock
• Ruby: Gemfile, Gemfile.lock

When an autoloop iteration modifies any of these, the push silently falls back to creating an issue instead of a PR (protected_files_policy: fallback-to-issue). The iteration's code is effectively lost.

This has blocked autoloop on:

• githubnext/apm — Go migration, go.mod/go.sum blocked every iteration
• githubnext/tsikit-learn — TS project, package.json/bunfig.toml blocked
• githubnext/tsessebe — same pattern

Fix

The autoloop workflow template (workflows/autoloop.md) should use the exclude form for protected-files to remove language-specific dev files from the default list:

create-pull-request:
    protected-files:
      policy: fallback-to-issue
      exclude:
        - go.mod
        - go.sum
        - package.json
        - package-lock.json
        - bun.lockb
        - bunfig.toml
        - yarn.lock
        - pnpm-lock.yaml
        - tsconfig.json
        - biome.json
        - requirements.txt
        - pyproject.toml
        - setup.py
        - setup.cfg
        - Pipfile
        - Pipfile.lock
        - Gemfile
        - Gemfile.lock

Same for push-to-pull-request-branch.

Files that should STAY protected: CODEOWNERS, README.md, AGENTS.md, CLAUDE.md, GEMINI.md, DESIGN.md, and .github/ (via protect_top_level_dot_folders).

Affected repos

• githubnext/tsikit-learn — fixed in PR #13, #15
• githubnext/apm — fixed in PR #37
• githubnext/tsessebe — already had max-patch-files but should also get the exclude list
• githubnext/autoloop — template itself needs updating so new installs get this by default