Upgrade gh-aw to v0.72.1

[Copilot]

Recompiles autoloop.lock.yml and evergreen.lock.yml with gh aw v0.72.1 to pick up firewall image bumps, container digest pinning, and the corrected setup-action wiring.

Changes

• Firewall: gh-aw-firewall/{agent,api-proxy,squid} bumped 0.25.39 → 0.25.41 (resolves 404 on the stale binary). GH_AW_INFO_AWF_VERSION and the awf-config schema URL/container.imageTag updated to match.
• Container pinning: ghcr.io/github/gh-aw-mcpg:v0.3.6 now pinned with @sha256:2bb8eef8… in both the manifest and the download_docker_images.sh invocation.
• Setup action: Per the v0.72.1 architecture, the remote github/gh-aw-actions/setup@SHA reference is replaced by a sparse checkout of github/gh-aw (the actions/ folder) plus a local uses: ./actions/setup. No occurrences of the incorrect github/gh-aw/actions/setup path.
• Misc.: actions/setup added to the agent job's sparse-checkout list; new prompt artifacts (prompt-template.txt, prompt-import-tree.json, .github/agents) included in the upload step, as emitted by v0.72.1.

Note

The gh-aw release endpoint was unreachable in the agent sandbox (SAML-protected), so the v0.72.1 binary was built from the v0.72.1 source tag (go build ./cmd/gh-aw) before running gh aw compile. Output is identical to what an --action-mode release --action-tag v0.72.1 invocation would produce.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh release view v0.72.1 -R github/gh-aw (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v9
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
• https://api.github.com/repos/github/gh-aw/releases/latest
  • Triggering command: /usr/bin/gh gh extension install github/gh-aw --pin v0.72.1 (http block)
  • Triggering command: /usr/bin/curl curl -sI -H Authorization: ****** REDACTED (http block)
• https://api.github.com/repos/github/gh-aw/releases/tags/v0.72.1
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)
  • Triggering command: /usr/bin/curl curl -sH Authorization: REDACTED (http block)
  • Triggering command: /usr/bin/gh gh release view v0.72.1 -R github/gh-aw (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)