agentic-workflow updates (network, integrity, upd of gh aw)

[DeagleGross]

Several things done here:

1. updated gh aw and recompiled merged workflows to 0.62.5
2. set min-integrity: none as per docs. Problem I am solving is that seems like there is another update from gh aw which dissalows MCP calls for searching issues:

✗ Fetch issue 65911 via GitHub API (shell)
  │ curl -s "https://api.github.com/repos/dotnet/aspnetcore/issues/65911" 2>&1 | head -50
  └ Permission denied and could not request permission from user

● issue_read
  └ []

● missing_data
  └ {"result":"success"}

I was unable to triage issue #65911 because the GitHub MCP server tools (`issue_read`, `list_issues`, `search_issues`) are all returning empty results for the `dotnet/aspnetcore` repository, and direct API calls are blocked by the network firewall.

3. fixed network access to trusted sources
4. only public repos to search from
5. use github-token: COPILOT_GITHUB_TOKEN for MCP searches of issues approved

[Copilot]

Pull request overview

Updates the repository’s gh-aw–generated agentic workflows to the newer gh-aw toolchain and refreshes the compiled/locked workflow outputs, including network and integrity guard configuration changes used by the GitHub MCP server integration.

Changes:

• Recompiled gh-aw locked workflows to gh-aw v0.62.5 and updated referenced action SHAs/binary versions (e.g., AWF v0.24.5, MCPG v0.1.20).
• Moved gh-aw runtime assets from /opt/gh-aw/... to ${{ runner.temp }} / ${RUNNER_TEMP} paths and adjusted Safe Outputs paths accordingly.
• Updated the issue triage workflow definition to allow additional network domains and set GitHub tool integrity filtering to none.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/test-quarantine.lock.yml	Recompiled locked workflow to gh-aw v0.62.5; updates runtime paths, firewall/container versions, and conclusion gating.
.github/workflows/issue-triage-agent.md	Updates workflow frontmatter to configure github.min-integrity: none and expand allowed network domains.
.github/workflows/issue-triage-agent.lock.yml	Recompiled locked workflow to gh-aw v0.62.5; updates runtime paths, firewall/container versions, MCP guard policy config, and conclusion gating.
.github/aw/actions-lock.json	Consolidates pinned gh-aw setup action version to v0.62.5.

[Copilot]

The GITHUB_TOOLSETS value here does not include search, but the triage agent workflow relies on searching for duplicate issues (e.g., search_issues). Without enabling the search toolset, the GitHub MCP server may not expose the search tools and duplicate detection will fail.

Consider adding search back to GITHUB_TOOLSETS (or otherwise ensuring the search_issues capability is enabled for this MCP server instance).

[DeagleGross]

Marked as draft for now: latest gh aw updates introduced some other token or whatever which blocks agentic workflow from reading issues (agent) and posting the labels on them (safe_outputs). Waiting for docs / support here

[DeagleGross]

It got unblocked