Extract concerns #1 (log/state dir setup) and #2 (chroot home
bind-mount prep) with their four private helpers into a new
src/workdir-setup.ts module.

- src/log-paths.ts: export LogPaths interface
- src/workdir-setup.ts: new module with prepareWorkDirectories()
- src/config-writer.ts: remove extracted code; call
  prepareWorkDirectories(); shrinks from 431 to ~194 lines
- src/workdir-setup.test.ts: 16 direct unit tests for the new module

Closes #4878

…orchestrator (#4896)

* Initial plan

* refactor: extract workdir setup from writeConfigs into workdir-setup.ts

Extract concerns #1 (log/state dir setup) and #2 (chroot home
bind-mount prep) with their four private helpers into a new
src/workdir-setup.ts module.

- src/log-paths.ts: export LogPaths interface
- src/workdir-setup.ts: new module with prepareWorkDirectories()
- src/config-writer.ts: remove extracted code; call
  prepareWorkDirectories(); shrinks from 431 to ~194 lines
- src/workdir-setup.test.ts: 16 direct unit tests for the new module

Closes #4878

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Landon Cox <landon.cox@microsoft.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Token-optimization pass on the Contribution Check workflow (ranked #1
by total AIC). All review data is already pre-fetched in `steps:`, so
the agent only needs to read three context files and emit a single
`add_comment` (or noop) safe-output.

Changes:
- tools: disable GitHub tools (`github: false`) instead of the previous
  `gh-proxy`/`pull_requests` config. NOTE: simply *removing* the tools
  block makes gh-aw auto-inject a read-only GitHub MCP server with a
  *broader* toolset (context,repos,issues,pull_requests), which is the
  opposite of the optimization goal. Explicit `github: false` drops the
  github-mcp-server and cli-proxy containers entirely and prevents the
  ~5.3 stray GitHub API calls/run the agent was making despite the
  prompt forbidding them. (lock file shrinks ~150 lines.) Keep `edit:`
  so the agent can read the pre-fetched files.
- strict: false -> true (also required removing the internal
  `sandbox.mcp.version` key, which strict mode disallows).
- max-turns: 5 -> 3 (linear task: read files -> compare -> comment).
- Prompt: add an explicit "only add_comment or noop" tool constraint.
- Recompiled contribution-check.lock.yml; updated the workflow test's
  max-turns assertion 5 -> 3.

Out of scope: recommendation #1 (all Copilot runs report null
token_usage) is a separate, systemic api-proxy telemetry-export
investigation, not a per-workflow change.

Refs #5558

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>