CLI proxy: start difc-proxy on host, pass --difc-proxy-host to AWF (#25366)

* Initial plan

* Initial plan for CLI proxy: start difc-proxy on host, pass new AWF flags

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/cd08abe8-65f6-4cd4-aca7-a2cfa59d7e81

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* feat: replace --enable-cli-proxy with --difc-proxy-host, start difc-proxy on host

When features.cli-proxy is enabled, the compiler now:
1. Starts a difc-proxy container on the host before AWF execution
2. Passes --difc-proxy-host host.docker.internal:18443 and
   --difc-proxy-ca-cert /tmp/gh-aw/difc-proxy-tls/ca.crt to AWF
3. Injects GH_TOKEN into the AWF step env with --exclude-env GH_TOKEN
4. Stops the CLI proxy container after AWF execution

Removed deprecated flags: --enable-cli-proxy, --cli-proxy-policy.
Minimum AWF version bumped to v0.26.0 for CLI proxy support.

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/cd08abe8-65f6-4cd4-aca7-a2cfa59d7e81

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* fix: address code review feedback for CLI proxy

- Handle empty policy gracefully in start_cli_proxy.sh (proxy starts
  without guard filtering when no policy is configured)
- Exit with error when proxy fails to start (prevents AWF from running
  with a non-functional proxy)
- Rename hasCliProxyNeeded to isCliProxyNeeded for naming consistency

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/cd08abe8-65f6-4cd4-aca7-a2cfa59d7e81

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* fix: address review feedback and recompile agentic workflows

- Bump DefaultFirewallVersion to v0.26.0 to align with AWFCliProxyMinVersion
- Gate addCliProxyGHTokenToEnv on awfSupportsCliProxy and awfSupportsExcludeEnv
  to prevent leaking GH_TOKEN into the agent container on older AWF versions
- Make start_cli_proxy.sh idempotent by removing any leftover container first
- Update changeset to describe current behavior (difc-proxy-host flags)
- Recompile all agentic workflows with updated DefaultFirewallVersion

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e59645aa-2981-470c-bd44-1075fd88317a

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

* fix: update golden files and lock file for AWF v0.26.0 version bump (#25400)

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/f16055db-4d7a-479e-acae-0713caf5344d

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* fix: update DefaultFirewallVersion to v0.25.17, fix shell quoting and docstring

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/35642b32-32d1-4a2d-bea7-8041bed78e77

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* fix: add parentheses to JSDoc type cast in copilot_driver.cjs for TypeScript compatibility (#25406)

* feat: increase logging in copilot driver for silent startup failures (#issue) (#25390)

* feat(logging): add debug logging to 5 CLI files for improved troubleshooting (#25393)

* fix: add parentheses to JSDoc type cast in copilot_driver.cjs for TypeScript compatibility

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/34f7e8b3-df09-41bc-b786-8bb4b22ebb7e

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Landon Cox <landon.cox@microsoft.com>

Author: 4 people