fix(workflows): stage Copilot CLI in AWF runs

[jamesadevine]

Summary

• upgrade all 26 GitHub agentic workflow locks from gh-aw v0.84.3 to v0.86.2
• stage the activated Copilot CLI at ${RUNNER_TEMP}/gh-aw/bin/copilot before every AWF agent, detection, and eval invocation
• regenerate the centralized slash-command router, maintenance workflow, action lock, and generated-file attributes
• explicitly disable bash in the two GitHub-tool-only workflows required by v0.86.2 strict mode

Root cause

Run https://github.com/githubnext/ado-aw/actions/runs/31777042905 installed Copilot CLI from /opt/hostedtoolcache, but the v0.84.3-generated workflow launched /usr/local/bin/copilot. The AWF harness therefore failed before the first agent turn with spawn /usr/local/bin/copilot ENOENT.

This uses the upstream fix from github/gh-aw#50908, released in gh-aw v0.86.2.

Validation

• gh aw compile --strict — 26 workflows compiled successfully
• verified all 26 locks use compiler v0.86.2
• verified every Copilot/AWF invocation uses ${RUNNER_TEMP}/gh-aw/bin/copilot
• verified no generated lock retains /usr/local/bin/copilot
• git diff --check

gh aw lint could not execute actionlint because Docker Desktop is unavailable locally; gh-aw v0.86.2 misleadingly reports that integration failure as zero lint issues before returning nonzero.

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[jamesadevine]

/review

[github-actions]

✅ PR Security Reviewer completed the security review.

🔒 Security review by PR Security Reviewer

[github-actions]

Compiler contract review

No findings. This PR only touches gh-aw-generated workflow artifacts (.github/workflows/*.lock.yml, agentic_commands.yml, agentics-maintenance.yml, .gitattributes, .github/aw/actions-lock.json) plus two trivial front-matter additions (bash: false) that were correctly recompiled into their matching .lock.yml files. Nothing under src/, docs/, scripts/ado-script/src/, or tests/safe-outputs/ changed, so none of ado-aw's own compiler contracts (front-matter grammar, safe-output schemas, typed IR, codemods, bundle/codegen drift) are affected by this upgrade.

🏗️ Compiler contract review by Compiler Contract Reviewer · auto · 21.9 AIC · ⌖ 8.67 AIC · ⊞ 12.1K
_{Comment /review to run again}

[github-actions]

Security review — no regressions found

This PR is a mechanical upstream gh-aw v0.84.3 → v0.86.2 recompilation of 26 generated .lock.yml files plus the Copilot CLI staging fix (copy the resolved copilot binary to a fixed ${RUNNER_TEMP}/gh-aw/bin/copilot path before invoking it via AWF). No ado-aw compiler source (src/) is touched.

Checked the security-relevant surface in the generated diff:

• Token exclusion list actually widens (hardens), not weakens: the AWF invocation now also excludes ACTIONS_ID_TOKEN_REQUEST_TOKEN / ACTIONS_ID_TOKEN_REQUEST_URL from the sandboxed container in addition to the existing COPILOT_GITHUB_TOKEN, GITHUB_MCP_SERVER_TOKEN, MCP_GATEWAY_API_KEY exclusions — this reduces, not increases, what the Agent stage can see.
• Copilot binary staging (GH_AW_COPILOT_SRC/GH_AW_COPILOT_BIN) resolves the CLI via command -v copilot (PATH lookup, not user input) and copies it to a fixed path before every invocation; no untrusted data flows into this path, and the script fails closed (exit 127) if the binary isn't found or executable.
• New --mount /tmp/gh-aw:/tmp/gh-aw:rw grants the sandboxed agent read-write access to the same path it already used for logs/cache-memory (--add-dir /tmp/gh-aw/, --add-dir /tmp/gh-aw/cache-memory/), so this doesn't appear to be a new credential-exposure surface beyond what the Agent stage already had.
• No changes to SYSTEM_ACCESSTOKEN/SC_WRITE_TOKEN projection, allowed_hosts.rs/ecosystem_domains.rs allowlists, safe-output sanitization, or validated newtypes — this PR doesn't touch any of those files.

No weakened validation, no injection paths, no token-scope widening. LGTM from a security standpoint.

🔒 Security review by PR Security Reviewer · auto · 48.4 AIC · ⌖ 5.73 AIC · ⊞ 11.5K
_{Comment /review to run again}