A repository requires every Copilot-generated pull request to include an agent-plan.json file before reviewers evaluate implementation changes. The file must contain the fields goal, scope, files_to_change, tests, and risks. The workflow should run on pull request activity and validate the plan without granting write permissions. Which option completes the workflow?

The correct option completes the workflow to validate the agent-plan.json file. Missing value 1 = pullrequest: The workflow needs to trigger on pull request activity, specifically when a PR is opened, synchronized (updated), or marked ready for review. pullrequest is the correct event for this. push triggers on code pushes, workflowdispatch allows manual triggering, and pullrequesttarget has different security implications and is not needed here. Missing value 2 = pull-requests: To read pull request metadata and files, the pull-requests: read permission is necessary. checks, issues, and actions are incorrect as they grant permissions for different GitHub features not directly related to reading PR content for validation in this context. Missing value 3 = run: The run keyword executes shell commands directly within the step, which is required to use test -f to check for file existence and jq -e to validate the JSON structure and required fields. uses is for executing pre-built actions.