Restore embedded cli-proxy digest pin for historical AWF 0.27.11

[Copilot]

gh aw compile only resolves container digests from embedded pins and the local actions-lock.json cache. For the historical AWF 0.27.11 image set, the embedded table was missing cli-proxy, so recompiles could silently emit that sidecar as tag-only while its siblings remained digest-pinned.

• Embedded historical firewall pins

  • Add the missing 0.27.11 container entries to the baked pin table for:
    • agent
    • api-proxy
    • cli-proxy
    • squid
  • This restores digest pinning when the local containers cache is absent or regenerated.

• Regression coverage

  • Add a focused compile test pinned to sandbox.agent.version: v0.27.11 with tools.github.mode: gh-proxy.
  • Assert that all four firewall sidecars are emitted with image / digest / pinned_image metadata and that the AWF image-tag config carries the expected digests.

• Representative pinned entry

  "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.11": {
    "image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.11",
    "digest": "sha256:1f989a7f2869c6a1b5f76bbbc645027966aa7e87b066d94734a901a7f371dfcd",
    "pinned_image": "ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.11@sha256:1f989a7f2869c6a1b5f76bbbc645027966aa7e87b066d94734a901a7f371dfcd"
  }

• Fixes Compile drops container digest pin: cli-proxy:0.27.11 missing from baked default pin table (v0.81.6) #47765