Use AWF --enable-chroot mode and remove unnecessary --mount and --env flags

[Mossaka]

Summary

Adopt the new --enable-chroot feature from AWF v0.13.1 to simplify the generated workflow commands by removing unnecessary --mount and --env flags.

Background

AWF v0.13.1 introduced --enable-chroot mode which provides transparent access to host binaries (Python, Node.js, Go, etc.) while maintaining network isolation. This eliminates the need for explicit volume mounts and environment variable passthrough since the chroot environment has direct access to the host filesystem.

Blocked By

• Update AWF (gh-aw-firewall) to v0.13.1 #13376 (Update AWF to v0.13.1)

Changes Required

1. Add --enable-chroot flag to AWF invocations in the workflow generator
2. Remove unnecessary --mount flags that were previously needed to expose host binaries/paths
3. Remove unnecessary --env flags that were previously needed to pass environment variables (chroot inherits host environment)

Benefits

• Simpler generated workflow commands
• Reduced configuration complexity
• Better compatibility with host tools and environments
• Cleaner workflow YAML output

Documentation

• Chroot mode docs: https://github.com/github/gh-aw-firewall/blob/main/docs/chroot-mode.md