`gh aw upgrade` does not correct drift between `uses:` comment version and `with: version:` in `copilot-setup-steps.yml`

[grahame-white]

Summary

When running gh aw upgrade, if your copilot-setup-steps.yml workflow contains:

- name: Install gh-aw extension
  uses: github/gh-aw/actions/setup-cli@cb7966564184443e601bd6135d5fbb534300070e # v0.58.0
  with:
    version: v0.53.6

then the hash and uses: comment are updated (e.g., to v0.60.0), but with: version: remains stale (e.g., at v0.53.6).

Root Cause

In upgradeSetupCliVersionInContent() (pkg/cli/copilot_setup.go), the update logic first rewrites the uses: line, then attempts to update the with: version: parameter by anchoring the regex to the new uses: value. If there was already version drift before running upgrade (e.g., someone manually bumped the uses: SHA or comment without changing the CLI version), the regex for with: version: silently fails to update the CLI version too, and the drift persists.

Steps to Reproduce

1. Create .github/workflows/copilot-setup-steps.yml with a uses: line comment (e.g. # v0.58.0) that does not match the with: version: (e.g. v0.53.6).
2. Run gh aw upgrade.
3. Observe that only the uses: line is updated; with: version: remains the old value.

Expected Behavior

gh aw upgrade should always update with: version: to match the new release, even if previous runs or manual edits left it stale relative to the uses: comment.

Implementation Plan

1. In upgradeSetupCliVersionInContent() (pkg/cli/copilot_setup.go), update the logic so that the with: version: line is found and updated independently of the already-modified uses: line. Use a pattern that always finds the relevant block, regardless of exact hash/tag/comment format or prior output.
2. Add test cases to pkg/cli/copilot_setup_test.go for pre-existing drift and ensure both fields update as expected.
3. Follow all project standards: error message style, build tags, and run make agent-finish before finish.

Files to Change

• pkg/cli/copilot_setup.go
• pkg/cli/copilot_setup_test.go

References

• Relevant code in copilot_setup.go
• copilot root cause analysis chat

[grahame-white]

The impact of having different versions is that the firewall panics during initialisation of the coding agent, see this run as an example.