Add memory-limit passthrough from workflow frontmatter to AWF

[Mossaka]

Problem

BuildAWFArgs() in pkg/workflow/awf_helpers.go never passes --memory-limit to AWF, even though AWF's CLI already supports this flag (--memory-limit <limit>, e.g. 4g, 8g). There is no way for workflow authors to configure per-workflow memory limits — every workflow gets AWF's default (currently 2GB, proposed to increase in githubnext/gh-aw-firewall).

Current State

• AWF CLI already supports --memory-limit flag (gh-aw-firewall/src/cli.ts:1214-1215)
• BuildAWFArgs() (pkg/workflow/awf_helpers.go:120-209) has no memory-related code
• AgentSandboxConfig (pkg/workflow/sandbox.go:44-53) has no memory field:

type AgentSandboxConfig struct {
    ID       string                `yaml:"id,omitempty"`
    Type     SandboxType           `yaml:"type,omitempty"`
    Disabled bool                  `yaml:"-"`
    Config   *SandboxRuntimeConfig `yaml:"config,omitempty"`
    Command  string                `yaml:"command,omitempty"`
    Args     []string              `yaml:"args,omitempty"`
    Env      map[string]string     `yaml:"env,omitempty"`
    Mounts   []string              `yaml:"mounts,omitempty"`
    // No memory field
}

Why This Matters

Even after increasing AWF's default memory limit (see githubnext/gh-aw-firewall issue), some workflows may need more or less memory than the default. Per-workflow configuration enables:

• Large projects (k9s, prettier) to request more memory
• Security-conscious workflows to restrict memory as a resource limit
• Different defaults per runner size (standard 7GB vs large runner 14GB+)

Proposed Changes

1. Add Memory field to AgentSandboxConfig

type AgentSandboxConfig struct {
    // ... existing fields ...
    Memory   string   `yaml:"memory,omitempty"`  // Memory limit for AWF container (e.g., "4g", "8g")
}

2. Pass --memory-limit in BuildAWFArgs()

// In BuildAWFArgs(), after existing args:
if agentConfig != nil && agentConfig.Memory != "" {
    awfArgs = append(awfArgs, "--memory-limit", agentConfig.Memory)
}

3. Workflow frontmatter usage

sandbox:
  agent:
    memory: "6g"

Or alternatively, a top-level resources field could be introduced:

resources:
  memory: "6g"

Workaround

Until this is implemented, users can use the existing args field:

sandbox:
  agent:
    args:
      - "--memory-limit"
      - "6g"

This works but is not discoverable or documented.