Fix container smoke detection fallback

[davidslater]

Summary

• Point generated container smoke detection at http://host.docker.internal:8080/reflect instead of container loopback.
• Regenerate the Copilot, Claude, and Codex container smoke lock files.
• Update the Codex CLI fallback to pass the prompt as the supported positional codex exec prompt instead of using unsupported --prompt-file.

Why

Container smoke detection was falling back to engine CLIs because /reflect was configured as http://127.0.0.1:8080/reflect inside the AWF container, where that points at container loopback and returns connection refused. Claude happened to succeed via CLI fallback, but Copilot and Codex did not. Codex also failed explicitly because @openai/codex@0.128.0 rejects codex exec --prompt-file.

Validation

• python3 scripts/create-threat-detection-sibling-workflows.py --check
• go test ./...
• make docker-smoke IMAGE_TAG=reflect-and-codex-fix

[Copilot]

Pull request overview

This PR fixes containerized smoke threat detection running inside the AWF container by pointing /reflect at the host (via host.docker.internal) instead of container loopback, and updates the Codex CLI invocation to use the supported codex exec positional prompt instead of --prompt-file.

Changes:

• Update generated container smoke workflows (and the generator) to set THREAT_DETECTION_REFLECT_URL to http://host.docker.internal:8080/reflect.
• Change Codex engine execution to pass the prompt as a positional argument to codex exec, and update unit tests accordingly.
• Regenerate the Copilot / Claude / Codex *-container.lock.yml workflow siblings with the new reflect URL.

Show a summary per file

File	Description
scripts/create-threat-detection-sibling-workflows.py	Updates container sibling generation to use host.docker.internal for reflect.
pkg/engine/engine.go	Changes Codex CLI invocation from prompt-file to positional prompt.
pkg/engine/engine_test.go	Updates tests to assert the new Codex argument format.
.github/workflows/smoke-copilot-container.lock.yml	Regenerated to use host.docker.internal reflect URL.
.github/workflows/smoke-codex-container.lock.yml	Regenerated to use host.docker.internal reflect URL.
.github/workflows/smoke-claude-container.lock.yml	Regenerated to use host.docker.internal reflect URL.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 6/6 changed files
• Comments generated: 2