Wire dynamic enclave delegation controller into the workflow runtime

.github/aw/actions-lock.json

@@ -505,6 +505,11 @@
       "digest": "sha256:d7ed4c9e923f3c8be6c7e8f568a2af937f397a4dd1d2030dcd28a01fb34e705f",
       "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.16@sha256:d7ed4c9e923f3c8be6c7e8f568a2af937f397a4dd1d2030dcd28a01fb34e705f"
     },
+    "ghcr.io/github/gh-aw-mcpg:v0.4.17": {
+      "image": "ghcr.io/github/gh-aw-mcpg:v0.4.17",
+      "digest": "sha256:29b2c79fa564958af43d64354d9faa8f4700e21e6f3a0b2c24c4d22199b27329",
+      "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.17@sha256:29b2c79fa564958af43d64354d9faa8f4700e21e6f3a0b2c24c4d22199b27329"
+    },
     "ghcr.io/github/gh-aw-node": {
       "image": "ghcr.io/github/gh-aw-node",
       "digest": "sha256:bac2192f6374d6262116399b34fc5e143d576f82719e90a18261cae7480f4d4e",

.github/aw/enclaves.md

@@ -54,7 +54,7 @@ Prefer this configuration shape for new workflows:
 ```yaml
 sandbox:
   mcp:
-    version: v0.4.16
+    version: v0.4.17
 enclaves:
   - agent:
       model: gpt-5
@@ -85,7 +85,7 @@ sandbox:
     id: awf
     version: v0.28.14
   mcp:
-    version: v0.4.16
+    version: v0.4.17
 enclaves:
   - agent:
       model: gpt-5
@@ -116,8 +116,8 @@ enclaves:
 - Each entry declares either non-empty static `repos` or `dynamic`, never both.
 - Declare `allowed-owners` or `allowed-repositories` using the ADR 0001 canonical lowercase ASCII selector form. The compiler does not trim, case-fold, URL-decode, or otherwise normalize dynamic selectors.
 - `github-policy` must be `github-repository-read-v1`, the closed policy containing only `list_issues` and `issue_read`.
-- Dynamic entries require fixed sensitivity, finite resource limits, total quotas, audit labels, an absolute `expires-at` no later than the enclave job lifetime, AWF `v0.28.14` or newer, and mcpg `v0.4.16` or newer.
-- The compiler emits the dynamic policy envelope and mcpg `github-repository-delegation-v1` controller. The delegation-control capability is AWF-only and is excluded from primary and enclave agent environments.
+- Dynamic entries require fixed sensitivity, finite resource limits, total quotas, audit labels, an absolute `expires-at` timestamp, AWF `v0.28.14` or newer, and mcpg `v0.4.17` or newer (the first mcpg release that accepts the delegation controller's atomic bootstrap configuration; see `github/gh-aw-mcpg#12605`). `expires-at` is an upper bound; the compiler resolves the effective envelope expiry at workflow setup time as `min(expires-at, job-start + enclave timeout)`.
+- The compiler emits the dynamic policy envelope and starts mcpg's `github-repository-delegation-v1` controller, then hands AWF a host-private delegation control endpoint. The delegation-control capability is AWF-only and is excluded from primary and enclave agent environments.
 
 ## Deprecated legacy profile