Add build step and timeout updates to smoke workflows (#11968)

* Initial plan

* Add build and test tasks to all smoke workflows

- Add 'make build' and 'make test' task to smoke-copilot.md
- Add 'make build' and 'make test' task to smoke-codex.md
- Add 'make test' task to smoke-claude.md (already has build test)
- Add 'make build' and 'make test' task to smoke-opencode.md
- Recompile all workflows to update .lock.yml files
- Minimal changes following update-agentic-workflow.md guidelines
- No UI changes

CI note: lint-go failure in run 21378132566 is unrelated (unused funcs in add_command.go and add_interactive.go)

* Add changeset [skip-ci]

* Merge main and regenerate workflows

* Regenerate workflows after merge with main

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Add changeset [skip-ci]

* chore: increase smoke workflow timeouts and remove make test

- Increase timeout from 5/10 minutes to 15 minutes for all smoke workflows
- Remove 'make test' from smoke test steps, keeping only 'make build'
- Affects: smoke-copilot, smoke-codex, smoke-claude, smoke-opencode
- All workflows already have 'go' runtime configured (no changes needed)

* Add runtimes: go to smoke-opencode workflow

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Add changeset [skip-ci]

* Recompile workflows after merging origin/main

Updates lock files for security-alert-burndown and security-guard workflows
to incorporate environment variable mirroring changes from main branch.

Changes:
- Add GH_AW_TOOL_BINS environment variable construction
- Pass additional runner environment variables (ANDROID_*, CARGO_HOME, etc.)
- Update PATH construction to use GH_AW_TOOL_BINS

Related to env-mirror feature from origin/main.

* Update artifact usage counts for security-guard workflow

* Add changeset [skip-ci]

* Fix shell escaping for environment variable expansion in AWF

Pre-wrap environment variable values in double quotes so they're
properly expanded inside AWF containers. This fixes the PATH priority
mechanism for tools from actions/setup-*.

Changes:
- env_mirror.go: Wrap mirrored env vars in double quotes
- engine_helpers.go: Wrap GH_AW_TOOL_BINS in double quotes
- Updated tests to expect the new format
- Regenerated all lock files

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Regenerate lock files after merge

* Add changeset [skip-ci]

* docs: Clarify engine selection in Quick Start guide (#12135)

* Use go env GOROOT instead of GOROOT env var for Go bin path

actions/setup-go doesn't export GOROOT as an environment variable
(only adds Go to PATH). This caused GH_AW_TOOL_BINS to not include
the Go bin path, resulting in older Go versions from hostedtoolcache
being used due to alphabetical find ordering.

Fix: Use `command -v go && $(go env GOROOT)/bin` to dynamically
determine GOROOT from the Go toolchain itself.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Add changeset [skip-ci]

* Merge main and regenerate agentic workflows

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix Go build cache permission error in AWF sandbox

Add $HOME/.cache mount to AWF container configuration for all engines
(Claude, Codex, Copilot). This allows Go's build cache and other tool
caches (npm, etc.) to be writable inside the sandbox container.

The directory is created with `mkdir -p "$HOME/.cache"` before AWF runs
to ensure the mount path exists on the host.

Also added /home/runner/.cache to the SRT sandbox's default AllowWrite
list for consistency.

Fixes permission denied errors when running `make build` inside the
agent container (e.g., smoke-codex workflow).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Add changeset [skip-ci]

* Use --dangerously-bypass-approvals-and-sandbox for Codex engine

Replace --full-auto and --sandbox danger-full-access flags with the
single --dangerously-bypass-approvals-and-sandbox flag which combines
both behaviors. This simplifies the command and is the recommended
approach for externally sandboxed environments like AWF.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Add changeset [skip-ci]

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Jiaxiao Zhou <duibao55328@gmail.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: 4 people

.changeset/patch-add-smoke-build-test.md

@@ -117,7 +117,7 @@ Analyze the user's response and map it to agentic workflows. Ask clarifying ques
    - 💡 If you detect the task requires **browser automation**, suggest the **`playwright`** tool.
    - 🔐 If building an **issue triage** workflow that should respond to issues filed by non-team members (users without write permission), suggest setting **`roles: read`** to allow any authenticated user to trigger the workflow. The default is `roles: [admin, maintainer, write]` which only allows team members.
 
-**Scheduling Best Practices:**  
+**Scheduling Best Practices:**
    - 📅 When creating a **daily or weekly scheduled workflow**, use **fuzzy scheduling** by simply specifying `daily` or `weekly` without a time. This allows the compiler to automatically distribute workflow execution times across the day, reducing load spikes.
    - ✨ **Recommended**: `schedule: daily` or `schedule: weekly` (fuzzy schedule - time will be scattered deterministically)
    - 🔄 **`workflow_dispatch:` is automatically added** - When you use fuzzy scheduling (`daily`, `weekly`, etc.), the compiler automatically adds `workflow_dispatch:` to allow manual runs. You don't need to explicitly include it.