fix: correct Squid access.log path and add runtime presence detection - #49557

Mirror how print_firewall_logs.sh already derives the path: the compiler exports AWF_LOGS_DIR; the JS side can use RUNNER_TEMP to construct the same base, or a new GH_AW_BASE_DIR env var:

const GH_AW_BASE = (process.env.RUNNER_TEMP && process.env.RUNNER_TEMP !== '')
  ? path.join(process.env.RUNNER_TEMP, 'gh-aw')
  : '/tmp/gh-aw';
const squidAccessLogPaths = [
  GH_AW_BASE + '/sandbox/firewall/logs/squid-logs/access.log',
  GH_AW_BASE + '/sandbox/firewall/logs/access.log',
];

Add a unit-test case that sets RUNNER_TEMP to confirm the path is derived dynamically.

The Go compiler deliberately redirects firewall logs to ${{ runner.temp }}/gh-aw/sandbox/firewall/logs on ARC/DinD topologies (see pkg/workflow/engine_firewall_support.go isArcDindTopology branches using constants.AWFProxyLogsDirExpr), because /tmp/gh-aw is not daemon-visible in that mode. print_firewall_logs.sh correctly receives this via the AWF_LOGS_DIR env var and checks the right location. This new .cjs script instead hardcodes /tmp/gh-aw/sandbox/firewall/logs/... with no environment override, so on ARC/DinD it will always report squidAccessLogPresent: false and emit the "cannot be audited" warning even when the log is present — exactly the false-positive class of bug this PR set out to fix.

const squidAccessLogPaths = [
  path.join(process.env.GH_AW_FIREWALL_LOGS_DIR || "/tmp/gh-aw/sandbox/firewall/logs", "squid-logs", "access.log"),
  path.join(process.env.GH_AW_FIREWALL_LOGS_DIR || "/tmp/gh-aw/sandbox/firewall/logs", "access.log"),
];

The generator step would need to pass the same resolved directory as an env var, mirroring what generateFirewallLogParsingStep already does for the shell script.

In pkg/workflow/compiler_yaml_ai_execution.go, generateObservabilitySummary returns immediately when !isOTLPEnabled(data), before this script is even wired into the workflow. Firewall can be enabled independently of OTLP tracing, so the majority of firewall-only workflows (no telemetry export configured) will never emit the squidAccessLogPresent line or the missing-log warning — silently defeating the stated goal of "surfaces a warning line when missing so operators see the gap without waiting for the daily report" for that common configuration.

// pkg/workflow/compiler_yaml_ai_execution.go
func (c *Compiler) generateObservabilitySummary(yaml *strings.Builder, data *WorkflowData) {
	if !isOTLPEnabled(data) {
		return // <- firewall-only workflows never reach the squid-log check below
	}
	...

Either decouple the squid-log presence check into its own step gated only on isFirewallEnabled(data), or relax the early return so firewall-only runs still get this diagnostic.

print_firewall_logs.sh has no accompanying test file in this diff, unlike generate_observability_summary.cjs which got four new Jest cases for the equivalent logic. The two implementations of the same "check current path, then legacy path" logic can now drift silently — e.g. if AWFProxyLogsDir changes in Go but only the .cjs array is updated (which is already stale per the ARC/DinD hardcoded-path issue noted elsewhere), this shell script would keep checking the old paths without any test catching the mismatch.

Consider adding a bats/shellspec test (or a minimal inline smoke test invoked from CI) that stubs AWF_LOGS_DIR, creates files at the current path, the legacy path, and neither, and asserts the WARNING line is/isn't emitted on stderr — mirroring the JS test matrix already added.