chore: upgrade gh-aw to v0.83.5 pre-release and recompile workflows

[lpcox]

Summary

Upgrades the gh-aw extension from v0.83.4 to v0.83.5 (pre-release) and recompiles all workflows.

Changes

gh-aw upgrade

• Updated gh-aw from v0.83.4 → v0.83.5
• Updated github/gh-aw-actions/setup-cli and github/gh-aw-actions/setup to v0.83.5

Workflow fixes (steps-output-in-prompt)

The v0.83.5 compiler introduced a new steps-output-in-prompt validation that rejects workflows referencing ${{ steps.X.outputs.Y }} in the prompt section (since those steps run in the agent job after the prompt is rendered in the activation job).

Fixed 15 workflows by migrating from $GITHUB_OUTPUT to file-based data passing (/tmp/gh-aw/agent/):

Smoke-data pattern (10 workflows):

• smoke-copilot, smoke-copilot-byok, smoke-copilot-byok-aoai-entra, smoke-copilot-network-isolation
• smoke-docker-sbx, smoke-docker-sbx-claude, smoke-docker-sbx-codex
• smoke-gvisor, smoke-gvisor-claude, smoke-gvisor-codex

Unique patterns (5 workflows):

• refactoring-scanner — file-sizes, function-counts → files
• security-guard — pr-meta, pr-diff, security-relevance → files
• self-hosted-runner-doctor-updater — scan window date → file
• test-coverage-improver — target file, source/test content, coverage data → files
• test-coverage-reporter — coverage-gaps-brief → file

Test updates

• Updated assertions in security-guard-workflow.test.ts, test-coverage-improver-workflow.test.ts, test-coverage-reporter-workflow.test.ts to match new file-based patterns
• Updated default model reference from claude-sonnet-4.6 → claude-sonnet-5

Compilation

All 58 workflows compile successfully (0 errors, warnings only)

Test results

All 273 test suites pass (4600 tests)

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	99.10%	99.13%	📈 +0.03%
Statements	98.99%	99.02%	📈 +0.03%
Functions	99.14%	99.14%	➡️ +0.00%
Branches	95.64%	95.64%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[Copilot]

Pull request overview

Upgrades gh-aw to v0.83.5, recompiles workflows, and replaces prompt-time step outputs with file-based agent context.

Changes:

• Updated gh-aw actions and generated workflows to v0.83.5.
• Migrated 15 workflows to /tmp/gh-aw/agent data handoff.
• Updated workflow assertions and the default Copilot model.

Show a summary per file

File	Description
.github/aw/actions-lock.json	Updates gh-aw action pins.
.github/workflows/agentics-maintenance.yml	Upgrades maintenance jobs.
.github/workflows/contribution-check.lock.yml	Recompiled workflow.
.github/workflows/copilot-token-usage-analyzer.lock.yml	Recompiled workflow.
.github/workflows/doc-maintainer.lock.yml	Recompiled workflow.
.github/workflows/duplicate-code-detector.lock.yml	Recompiled workflow.
.github/workflows/export-audit.lock.yml	Recompiled workflow.
.github/workflows/refactoring-scanner.md	Stages scanner metrics in files.
.github/workflows/security-guard.md	Stages PR security context in files.
.github/workflows/self-hosted-runner-doctor-updater.md	Stages scan date in a file.
.github/workflows/smoke-claude.lock.yml	Recompiled workflow.
.github/workflows/smoke-copilot-byok-aoai-entra.md	Migrates smoke results to files.
.github/workflows/smoke-copilot-byok.md	Migrates smoke results to files.
.github/workflows/smoke-copilot-network-isolation.md	Migrates PR data to a file.
.github/workflows/smoke-copilot.md	Migrates smoke results to files.
.github/workflows/smoke-docker-sbx-claude.md	Migrates smoke results to files.
.github/workflows/smoke-docker-sbx-codex.md	Migrates smoke results to files.
.github/workflows/smoke-docker-sbx.md	Migrates smoke results to files.
.github/workflows/smoke-gvisor-claude.md	Migrates smoke results to files.
.github/workflows/smoke-gvisor-codex.md	Migrates smoke results to files.
.github/workflows/smoke-gvisor.md	Migrates smoke results to files.
.github/workflows/test-coverage-improver.md	Stages coverage and source context.
.github/workflows/test-coverage-reporter.md	Stages coverage-gap brief.
scripts/ci/security-guard-workflow.test.ts	Updates security workflow assertion.
scripts/ci/test-coverage-improver-workflow.test.ts	Updates file-handoff assertions.
scripts/ci/test-coverage-reporter-workflow.test.ts	Updates compiler environment assertion.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 34/78 changed files
• Comments generated: 2
• Review effort level: Medium

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Addressed both review comments in commit fix: address test-coverage workflow review feedback:

test-coverage-improver.md — Added cat permissions for all six staged agent files (/tmp/gh-aw/agent/source-content.txt, test-content.txt, target-file.txt, target-test-file.txt, coverage-md.txt, low-coverage.txt) to the bash tools whitelist. Updated the turn budget from ≤ 6 → ≤ 7 tool calls with a required step 1 batched read (cat /tmp/gh-aw/agent/target-file.txt /tmp/gh-aw/agent/source-content.txt ...), and removed the contradictory "Do not use cat tools to re-read them" instruction that conflicted with the file-based data passing.

test-coverage-reporter.md — Changed bash: false to bash: ["cat:/tmp/gh-aw/agent/coverage-gaps-brief.txt"] (narrowly scoped read access for that one staged file), and updated the prompt instruction from the ambiguous (read from … via cat …) form to a direct Run cat /tmp/gh-aw/agent/coverage-gaps-brief.txt directive. The lock files were patched to add shell(cat:/tmp/gh-aw/agent/...) to the agent --allow-tool flags. All 273 test suites (4600 tests) pass.

[github-actions]

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.