Align AWF enclave configuration with gh-aw frontmatter

[lpcox]

Context

The gh-aw compiler enclave frontmatter and generated AWF configuration need to remain structurally identical across:

• Compile unified AWF enclaves through mcpg gh-aw#50920
• fix: align enclave config with keyed compiler contract #7232
• the unified enclave work in feat: route unified enclaves exclusively through mcpg #6992

Required contract

sandbox:
  agent:
    id: awf
    sudo: false

enclaves:
  - script:
    repos:
      - repo: octo-org/private-service
        sensitivity: confidential
    timeout: 45
  - agent:
      model: gpt-5
    repos:
      - repo: octo-org/private-service
        sensitivity: confidential
    timeout: 180

The generated AWF JSON must preserve the same keyed-array structure:

{
  "enclaves": [
    {
      "script": {},
      "repos": [{ "repo": "octo-org/private-service", "sensitivity": "confidential" }],
      "timeout": 45
    },
    {
      "agent": { "model": "gpt-5" },
      "repos": [{ "repo": "octo-org/private-service", "sensitivity": "confidential" }],
      "timeout": 180
    }
  ]
}

Acceptance criteria

• enclaves is top-level alongside sandbox.
• Entries are discriminated by exactly one script or agent key.
• Repository entries use repos, not repositories or privateRepos.
• At most one entry exists per executor type.
• agent.model is required; an empty script object is valid.
• Shared repositories use identical sensitivity and one information budget across executor types.
• Script network none, script interpreter python3, and agent network api-proxy-only remain AWF-owned invariants.
• Script and agent timeouts default to 30 and 120 seconds and reject values above 540 seconds.
• Canonical enclave MCP tools use fixed toolTimeout: 630, covering the 600-second disclosure bucket plus 30-second transport allowance.
• Frontmatter examples, AWF schema, parser types, validation, and generated-config tests use the same shape and limits.
• Legacy { enabled, privateRepos, executors }, { type, repositories }, and bounded executor shapes are removed when migration sequencing permits.