Use envsubst with quoted heredoc for environment variable substitution

[Copilot]

Switches prompt heredoc generation from unquoted heredoc to quoted heredoc piped through envsubst. This allows safe environment variable substitution while preventing shell command execution in the heredoc content.

Before:

cat >> "$GH_AW_PROMPT" << PROMPT_EOF
...content with $VARS...
PROMPT_EOF

After:

cat << 'PROMPT_EOF' | envsubst >> "$GH_AW_PROMPT"
...content with $VARS...
PROMPT_EOF

Changes

• Core heredoc generation: Updated compiler_yaml.go, sh.go, and prompt_step.go to use quoted heredoc with envsubst pipe
• Prompt files restored: Reverted accidental removal of backticks in markdown prompt templates (temp_folder_prompt.md, edit_tool_prompt.md, playwright_prompt.md, pr_context_prompt.md, github_context_prompt.md)
• Tests updated: All heredoc pattern assertions updated across test files to match new syntax
• Lock files recompiled: All 77 workflow lock files regenerated with new pattern

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[pelikhan]

@copilot there should be only one way to do heredoc and it is quoted + envsubst. Never allow doing unquoted with shell execution.

[pelikhan]

@copilot remove generation of shell heck comment

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)