Fix gh-aw compile warnings

[Copilot]

make compile produced dozens of warnings across deprecated config patterns, stale action versions, and invalid frontmatter fields. This PR eliminates all addressable warnings.

Changes

engine.model → top-level model (57 files)

All workflow .md sources migrated from the deprecated nested form to the new top-level field:

# Before
engine:
  id: copilot
  model: ${{ inputs.model }}

# After
engine:
  id: copilot
model: ${{ inputs.model }}

/tmp/ path references → /tmp/gh-aw/agent/

Fragments and workflow files updated to use the compiler-approved root for agent-generated temp files:

• previous-findings.md, pr-context.md, safe-output-push-to-pr.md fragments
• gh-aw-pr-review.md, gh-aw-stale-issues-remediator.md, gh-aw-scheduled-audit.md, gh-aw-scheduled-fix.md, and others

safe-inputs: removed (3 fragment files)

Removed unrecognized safe-inputs: frontmatter blocks from safe-output-create-pr.md, safe-output-code-review.md, and safe-output-push-to-pr.md — the compiler ignores this field entirely and the embedded Python tools were never registered in compiled output.

Playwright MCP → CLI mode

playwright-mcp-explorer.md rewritten to use mode: cli (no Docker, more token-efficient, supports localhost).

Outdated action versions

• runtime-setup.md: setup-go@v5→v7, setup-python@v5→v6, setup-node@v6→v7, setup-uv@v5→v8
• gh-aw-pr-labeler.md: github-script@v7→v9

Remaining warnings (not addressed)

• Secrets in agent job (estc-pr-buildkite-detective.md): fixing requires extracting Buildkite fetch into a separate pre-job — architectural change deferred
• Sandbox disabled: intentional for -no-sandbox workflow variants
• Fuzzy schedule scattering: local build environment artifact (no git remote); absent in CI

[v1v]

@copilot create one PR per type of fix

[Copilot]

@v1v I've opened a new pull request, #1625, to work on those changes. Once the pull request is ready, I'll request review from you.