Add protected-files: allowed to evergreen workflow

[Copilot]

Evergreen agent fails to push fixes when PR changes touch protected files (e.g., .github/ paths, package.json). The push-to-pull-request-branch safe output needs the protected-files: allowed policy to permit editing all files.

• Added protected-files: allowed to push-to-pull-request-branch in evergreen.md
• Recompiled evergreen.lock.yml via gh aw compile

safe-outputs:
  push-to-pull-request-branch:
    target: "*"
    max: 3
    protected-files: allowed