Activate smoke-opencode workflow via copilot engine workaround (#1991)

* Initial plan

* chore: compile and activate smoke-opencode workflow using copilot engine workaround

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/0a83108c-36ca-449c-91ba-6380c09d582d

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* docs: remove pending compilation note from smoke-opencode.md

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/0a83108c-36ca-449c-91ba-6380c09d582d

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

* fix: pin gh-aw-actions/setup to commit SHA

Replace bare tag reference (v0.68.3) with the resolved
commit SHA (abea67e0) in the lock file manifest and all
uses: directives for supply-chain safety.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: simulate sudo context in GITHUB_ENV fallback test

The toolchain var recovery from $GITHUB_ENV only activates
when runningUnderSudo is true (uid 0 + SUDO_UID set). The
test was missing this context, causing the assertion to fail
on both main and PR branches.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Co-authored-by: Landon Cox <landon.cox@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

.github/aw/actions-lock.json

@@ -45,11 +45,6 @@
       "version": "v4.0.0",
       "sha": "4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd"
     },
-    "github/gh-aw-actions/setup@v0.68.2": {
-      "repo": "github/gh-aw-actions/setup",
-      "version": "v0.68.2",
-      "sha": "19c436149e80e5be4f0adbd9cdeb391acea5fa91"
-    },
     "github/gh-aw/actions/setup@v0.68.1": {
       "repo": "github/gh-aw/actions/setup",
       "version": "v0.68.1",