fix: remove duplicate paragraph and revert cron in firewall-issue-dispatcher

.github/workflows/firewall-issue-dispatcher.md

@@ -65,15 +65,21 @@ gh api graphql -f query='
 
 ## Step 2: Filter Locally
 
-For each issue found, read its comments and check whether any comment contains a reference to a `github/gh-aw-firewall` issue (i.e., a URL matching `https://github.com/github/gh-aw-firewall/issues/` or a GitHub cross-repo reference matching `github/gh-aw-firewall#`). If such a comment exists, **skip** that issue — it has already been audited.
+For each issue found, read its comments and check whether any comment contains a reference to a `github/gh-aw-firewall` issue (i.e., a URL matching `https://github.com/github/gh-aw-firewall/issues/` or a GitHub cross-repo reference matching `github/gh-aw-firewall#`). If such a comment exists, **skip** that issue — it has already been audited. Do this filtering in your analysis — do NOT make additional API calls.
 
 If no unprocessed issues remain, call `noop` and stop.
 
 ## Step 3: Create Tracking Issues
 
 For each **unprocessed** issue:
 
-4. **Comment on the original `github/gh-aw` issue** linking to the newly created tracking issue. Use this exact format:
+1. **Create a tracking issue in `github/gh-aw-firewall`** using the `create_issue` safe output with:
+   - Title: `[awf] <component>: <summary>`
+   - Body: **Problem**, **Context** (link to original), **Root Cause**, **Proposed Solution**
+   - Labels: `awf-triage`
+   - Reference specific source files. See `AGENTS.md` for component descriptions.
+
+2. **Comment on the original `github/gh-aw` issue** linking to the newly created tracking issue. Use this exact format:
 
    > 🔗 AWF tracking issue: https://github.com/github/gh-aw-firewall/issues/{NUMBER}