fix: address review feedback and recompile agentic workflows

- Bump DefaultFirewallVersion to v0.26.0 to align with AWFCliProxyMinVersion
- Gate addCliProxyGHTokenToEnv on awfSupportsCliProxy and awfSupportsExcludeEnv
  to prevent leaking GH_TOKEN into the agent container on older AWF versions
- Make start_cli_proxy.sh idempotent by removing any leftover container first
- Update changeset to describe current behavior (difc-proxy-host flags)
- Recompile all agentic workflows with updated DefaultFirewallVersion

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e59645aa-2981-470c-bd44-1075fd88317a

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Author: Copilot