fix: update DefaultFirewallVersion and AWFExcludeEnvMinVersion to v0.25.3

[Copilot]

The CI version availability check was failing because DefaultFirewallVersion and AWFExcludeEnvMinVersion were both set to v0.26.0, which does not exist as a gh-aw-firewall release. The --exclude-env flag was actually shipped in v0.25.3.

Changes

• pkg/constants/constants.go: DefaultFirewallVersion and AWFExcludeEnvMinVersion v0.26.0 → v0.25.3
• pkg/workflow/awf_helpers.go: Updated 3 comments that referenced v0.26.0 as the minimum
• pkg/workflow/awf_helpers_test.go: Updated comment; added v0.25.3 (positive boundary) and v0.25.2 (negative boundary) test cases to TestAWFSupportsExcludeEnv
• Golden files (basic-copilot, with-imports, smoke-copilot): 0.26.0 → 0.25.3 in --image-tag, install script args, and GH_AW_INFO_AWF_VERSION
• Stale comments in firewall_image_tag_test.go and gh_cli_mount_test.go updated to reference v0.25.3

[pelikhan]

@copilot Recompute

[Copilot]

@copilot Recompute

Done in 0a54d1b — recompiled all 178 workflow lock files, updating v0.26.0 → v0.25.3 throughout (AWF install scripts, Docker image tags, and GH_AW_INFO_AWF_VERSION env vars).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0 --jq .object.sha (http block)
• https://api.github.com/repos/githubnext/agentics/git/ref/tags/
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)