templates: reference triggers.yaml with WT-ADV safe defaults (M41)

version: 2 + auto_advance default deny — imported projects are inert until
a human applies a grant tag (spec/workflow-triggers.md §3b WT-ADV-8).

Claude-Session: https://claude.ai/code/session_012arAwUuBQrpnMzJ36mEVBk

task-templates/triggers/triggers-template.yaml

@@ -0,0 +1,34 @@
+# Reference triggers.yaml for new projects — copy to the project's
+# workflow-triggers CRS attachment and edit.
+#
+# version: 2 REQUIRES the auto_advance section (WT-ADV-8,
+# spec/workflow-triggers.md §3b): an imported project's rules are INERT
+# until a human tags an item with a grant tag. This is deliberate —
+# attaching trigger rules must never, by itself, start dispatching work.
+version: 2
+mode: observe   # flip to enforce only after ≥3 nights of observe (WT-OBS-11)
+
+auto_advance:
+  default: deny
+  stop_tag: auto-advance-stop
+  grants:
+    # "milestone tagged auto-advance ⇒ advance it and all its children"
+    - tag: auto-advance
+      stages: all
+      inherit: true
+    # Example of a stage-scoped, non-inheriting grant:
+    # - tag: ai-driven
+    #   applies_to: [epic]
+    #   stages: {epic: [planning, spec]}
+    #   inherit: false
+
+triggers:
+  # Add project rules here. Example:
+  - name: example-noop
+    on_events: [item_state_changed]
+    match:
+      state: __never-matches__
+    action:
+      kind: dispatch_workflow
+      template: replace-me
+      version: 1