docs(hub): document workflow security boundaries (#3032)

* docs(hub): add security guidance for workflows

* docs: register Hub security guide

public-docs/hub/configuration/hub-yml.md

@@ -103,7 +103,7 @@ The grammar supports paths, JSON literals, parentheses, `!`, `==`, `!=`, `&&`, `
 | `environment`   | yes      | Environment name or a finite input expression resolving to one.                                                   |
 | `max_runtime`   | yes      | Positive step hard limit, up to 24h.                                                                              |
 | `idle_timeout`  | yes      | Positive idle limit, no longer than the step hard limit.                                                          |
-| `agent`         | yes      | `provider`, optional `model`, `mode`, and `thinkingOptionId`.                                                     |
+| `agent`         | yes      | `provider`, optional `model`, `mode`, `thinkingOptionId`, and provider-native `options`.                          |
 | `prompt`        | yes      | Non-empty list of `text` and GitHub-only `include` blocks.                                                        |
 | `if`            | no       | Expression deciding whether this ordered step runs.                                                               |
 | `output`        | no       | `{ schema: <JSON Schema> }` for structured `finish_execution`.                                                    |
@@ -120,6 +120,8 @@ prompt:
 
 Use `${{ paseo.prompt }}`, `${{ paseo.inputs.* }}`, `${{ steps.*.outputs.* }}`, and `${{ values.* }}` in prompts, conditions, and agent selection fields. Provider event payloads are not part of this workflow expression namespace; provider adapters put the normalized request into the prompt and preserve the raw event as evidence.
 
+`agent.options` carries JSON-safe options using the selected provider's native names and nesting. Paseo validates them with that provider's strict schema before starting the session. See [Hub security](/docs/hub/security) for the trust boundary and copyable provider examples.
+
 #### Output capabilities
 
 `allow_outputs` separates permission from obligation. `max` limits how many times a capability may be emitted and defaults to `1`. Set `required: true` when the step must emit that capability at least once before it can finish successfully:

public-docs/hub/configuration/index.md

@@ -81,4 +81,6 @@ While a project uses a GitHub source, the dashboard editor is read-only. The rep
 
 `filters.repo` can name any repository the organization has a connection for. Keeping `hub.yml` in a private repository while triggers watch several public ones is a common setup, because push access to the configuration repository grants access to the organization's connections.
 
+Treat the configuration repository as part of the security boundary. [Hub security](/docs/hub/security) covers what a changed configuration can authorize and how to limit the resulting agent process.
+
 Next: [Hub workflows](/docs/hub/workflows), then the [`hub.yml` reference](/docs/hub/configuration/hub-yml).