fix: sanitize auto-pilot LangSmith env exports

[stranske]

Summary

• sanitize LangSmith trace ID/URL values before appending them to GITHUB_ENV in auto-pilot optimize/apply steps
• update both the first-party workflow and consumer template source

Validation

• python scripts/validate_workflow_yaml.py .github/workflows/agents-auto-pilot.yml templates/consumer-repo/.github/workflows/agents-auto-pilot.yml
• python scripts/validate_template_sync.py
• /opt/homebrew/bin/actionlint .github/workflows/agents-auto-pilot.yml templates/consumer-repo/.github/workflows/agents-auto-pilot.yml

Addresses sync review feedback from stranske/Inv-Man-Intake#436.

[stranske-keepalive]

Workflow source detected

PR #2125 now has valid workflow source context (origin=sync_campaign).

No linked GitHub issue is required for this PR.

[stranske]

Post-push review sweep: no inline review comments or submitted reviews were present immediately after opening. Local focused validation passed (workflow YAML parser, template sync validator, Homebrew actionlint). GitHub checks are currently pending.

[Copilot]

Pull request overview

This PR hardens the auto-pilot workflow’s LangSmith trace export handling by stripping CR/LF characters before appending trace IDs and URLs to GITHUB_ENV, reducing env-file injection risk while keeping the first-party workflow and consumer template aligned.

Changes:

• Added a small sanitizer helper for LangSmith trace values in optimize and apply steps.
• Applied the same changes to the consumer template workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/agents-auto-pilot.yml	Sanitizes optimize/apply LangSmith trace values before writing to GITHUB_ENV.
templates/consumer-repo/.github/workflows/agents-auto-pilot.yml	Mirrors the auto-pilot workflow sanitization in the consumer template.

[stranske-keepalive]

Automated Status Summary

Head SHA: 31416e1
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / guard
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[github-actions]

Runner dispatch state for codex on PR #2125. Do not edit.