chore: upgrade gh-aw workflows to v0.88.0

[lpcox]

Summary

• upgrade the gh-aw extension and generated workflow actions to v0.88.0 using gh aw upgrade --pre-releases
• recompile all agentic workflow lock files
• restore repository-local AWF build/install steps in smoke and build-test workflows
• update the vendored agentic-workflows skill references

Testing

• npm test -- --runInBand (5,455 tests passed)

[Copilot]

Copilot review overview

🟡 Changes recommended

Four active Cloud Hypervisor lock files remain generated by v0.87.10, leaving the repository-wide upgrade incomplete.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	.github/​aw/​actions-lock.json — The upgrade is incomplete: smoke-cloud-hypervisor.lock.yml,…

What changed in this PR

Upgrades selected agentic workflows and dependencies to gh-aw v0.88.0.

Changes:

• Regenerates workflow locks with updated setup actions, metadata, and images.
• Updates AWF references to v0.28.12.
• Adds Playwright guidance and removes the obsolete Playwright MCP image lock.

File	Description
.github/​workflows/​smoke-playwright-runc.lock.yml	Regenerates runc Playwright smoke workflow.
.github/​workflows/​smoke-playwright-gvisor.lock.yml	Regenerates gVisor Playwright smoke workflow.
.github/​workflows/​smoke-playwright-docker-sbx.lock.yml	Regenerates Docker SBX Playwright smoke workflow.
.github/​workflows/​smoke-playwright-cloud-hypervisor.lock.yml	Regenerates Cloud Hypervisor Playwright workflow.
.github/​workflows/​smoke-enclave-issues-read.lock.yml	Updates enclave issue-read workflow.
.github/​workflows/​smoke-enclave-build-test.lock.yml	Updates enclave build-test workflow.
.github/​workflows/​smoke-claude.lock.yml	Updates Claude smoke workflow and AWF pins.
.github/​workflows/​export-audit.lock.yml	Updates export-audit workflow dependencies.
.github/​workflows/​duplicate-code-detector.lock.yml	Updates duplicate-code workflow dependencies.
.github/​workflows/​contribution-check.lock.yml	Updates contribution-check workflow dependencies.
.github/​skills/​agentic-workflows/​SKILL.md	Adds Playwright workflow guidance reference.
.github/​aw/​actions-lock.json	Refreshes action and container pins.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[lpcox]

@copilot address review feedback and fix this failing ci check https://github.com/github/gh-aw-firewall/actions/runs/33628212631/job/100240929505?pr=8004

[Copilot]

@copilot address review feedback and fix this failing ci check https://github.com/github/gh-aw-firewall/actions/runs/33628212631/job/100240929505?pr=8004

Addressed in 524bb5b. The four Cloud Hypervisor workflow sources now use AWF v0.28.11, their locks were regenerated with gh-aw v0.88.0 and postprocessed, and the CI scan failure was addressed by bumping the embedded GitHub CLI build to v2.98.0 (which carries patched google.golang.org/grpc). Targeted workflow tests, secret scan, and CodeQL all passed.

[github-actions]

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[lpcox]

@copilot rebase onto main

[Copilot]

@copilot rebase onto main

Merged origin/main into the branch in 71ea24f. I used a merge commit rather than a rebase because publishing a rebase would require rewriting history/force-pushing, which this environment cannot do. Resolved the Dockerfile conflicts, verified the merge has two parents, and ran targeted tests, API proxy tests, secret scan, build/commit hooks, and CodeQL successfully.