feat: update gh-aw-metadata payload to v3 with agent id/model and detection agent id/model

[Copilot]

Summary

Updates the gh-aw-metadata comment embedded in compiled lock files from schema v2 to v3, adding four new fields to capture the configured agent and detection agent information at compile time.

New Metadata Format (v3)

# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"...","strict":true,"agent_id":"copilot","agent_model":"gpt-5","detection_agent_id":"copilot","detection_agent_model":"gpt-5.1-codex-mini"}

New Fields (all omitempty)

Field	Description
agent_id	Engine/agent identifier (e.g., "copilot", "claude", "codex")
agent_model	Statically configured model for the agent (omitted if using runtime env var)
detection_agent_id	Detection engine identifier (omitted if using default/main engine)
detection_agent_model	Detection engine model (omitted if not explicitly configured)

Changes

• pkg/workflow/lock_schema.go: Added LockSchemaV3 constant, added it to SupportedSchemaVersions, added 4 new omitempty JSON fields to LockMetadata, added AgentMetadataInfo struct, updated GenerateLockMetadata to use v3 and accept agent info
• pkg/workflow/compiler_yaml.go: Updated call site to extract agent/detection info from WorkflowData (prefers EngineConfig.ID, falls back to legacy AI field; detection info comes from SafeOutputs.ThreatDetection.EngineConfig)
• pkg/workflow/lock_schema_test.go: Updated tests for v3 as current schema, added tests for new agent fields, updated "unsupported future version" test cases to use v4
• 177 workflow lock files recompiled to emit v3 metadata

Backward Compatibility

• v1 and v2 lock files continue to parse and validate correctly
• New fields are omitempty — existing v3 files without agent fields are still valid
• IsSchemaVersionSupported now returns true for v1, v2, and v3

[Copilot]

Pull request overview

Updates the embedded gh-aw-metadata header in compiled workflow lock files from schema v2 to v3, adding agent and detection-agent identifiers/models captured at compile time.

Changes:

• Introduces LockSchemaV3 and extends LockMetadata with agent/detection-agent fields; updates supported schema versions.
• Updates YAML compilation to populate agent metadata from WorkflowData and emit v3 metadata.
• Updates lock schema tests for v3 and adds coverage for the new metadata fields; recompiles workflow lock files to emit v3 metadata.

Reviewed changes

Copilot reviewed 180 out of 180 changed files in this pull request and generated 1 comment.

File	Description
pkg/workflow/lock_schema.go	Adds schema v3 and new metadata fields; updates metadata generation to emit v3 and include agent info.
pkg/workflow/compiler_yaml.go	Extracts agent/detection-agent info from workflow data and passes it into lock metadata generation.
pkg/workflow/lock_schema_test.go	Updates schema/version expectations to v3 and adds tests for agent metadata JSON (omitempty + extraction).
.github/workflows/*.lock.yml	Recompiled lock files to emit v3 gh-aw-metadata (and includes other regenerated workflow content in places).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The generated step passes the safe-outputs action payload as a single payload input to actions-ecosystem/action-add-labels, but the safe-output action handler exports a JSON object of action inputs (see actions/setup/js/safe_output_action_handler.cjs docs) that is typically consumed via fromJSON(...).<input>. Unless this third-party action explicitly supports a payload input, the step likely won’t receive required inputs (e.g., labels/issue number) and may fail or no-op. Consider reverting to per-input mapping from the JSON output (or switching uses: to an action that accepts a JSON payload).