feat: add smoke-services workflow for --allow-host-service-ports e2e testing (#1534)

* feat: add smoke-services workflow for --allow-host-service-ports e2e testing

Add a new smoke test workflow that validates the full path:
  services: port mappings → --allow-host-service-ports → iptables rules
  → agent reaches Redis and PostgreSQL on localhost

The workflow:
- Declares Redis (6379) and PostgreSQL (5432) as GitHub Actions services
- Passes compiler-generated port expressions to --allow-host-service-ports
- Agent installs redis-tools/postgresql-client and verifies connectivity
- Validates PING/PONG for Redis, pg_isready + SELECT 1 for PostgreSQL

Also registers the new lock file in postprocess-smoke-workflows.ts.

Closes #1525

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: use host.docker.internal and fix safe outputs validation

Two CI fixes:
1. Agent connects to host.docker.internal instead of localhost
   (localhost inside the AWF container is the container itself,
   not the host where GitHub Actions services run)
2. Add GH_AW_SAFE_OUTPUTS env var to the validate step so it
   reads the outputs file from the correct v0.64.5 path

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: rephrase prompt to avoid threat detection false positive

Rewrite the test instructions to be less prescriptive about output
format. The previous prompt explicitly described PASS/FAIL format
and tool actions (add comment, add label), which the threat
detection model misinterpreted as a pre-fabricated injection payload.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: lpcox

.github/aw/actions-lock.json

@@ -40,6 +40,11 @@
       "version": "v0.63.0",
       "sha": "9128d2542bbf1bdfec94dabeaf3e1d3c0d402577"
     },
+    "github/gh-aw-actions/setup@v0.64.5": {
+      "repo": "github/gh-aw-actions/setup",
+      "version": "v0.64.5",
+      "sha": "5d2ebfd87a1a45a8a8323c1a12c01b055730dac5"
+    },
     "github/gh-aw/actions/setup@v0.42.0": {
       "repo": "github/gh-aw/actions/setup",
       "version": "v0.42.0",