#387 Give the side-scan a copilot it can reach from the chroot

Every warning on #373 is one failure repeated: the compiled detection job hardcodes /usr/local/bin/copilot, which does not exist inside its chroot sandbox, so the scan dies at spawn in four milliseconds with zero output and the empty log reads as parse_error. The side-scan has never actually scanned anything since it was turned back on; the earlier model fix cured the previous cause, not this one.

Recompiling with gh-aw v0.86.2 points the detection harness at the runner-temp copilot the chroot can see. The deepseek model pins stay, the external-detector path with its unpinned latest-release fetch does not compile in, and the only moved action pin is gh-aw setup at its matching sha. The version is a pinned prerelease on purpose: stable v0.85.4 is what emits the dead path, and the 0.86 line carries the detection chroot fixes. The extension now installs from github/gh-aw, where the project moved; the old githubnext home stops at v0.85.4 and made upgrade report up to date.

This PR is its own testbed: the review lane runs these locks against it, so a green detection job here with no fresh parse_error comment on #373 is the fix demonstrated live.

---

Summary by cubic

Fixes the side-scan crash in the chroot by pointing the detector to a reachable Copilot binary. Also pins the commands dispatcher to the locked setup SHA to prevent tag drift.

• Bug Fixes

  • Detector now uses the runner-temp copilot instead of /usr/local/bin/copilot, which wasn’t in the chroot.
  • Removed the external-detector build path and kept model pins for stable, reproducible runs.

• Dependencies

  • Updated and pinned github/gh-aw-actions/setup to v0.86.2 by SHA across workflows and the commands dispatcher; locks reflect the new compiler.
  • Extension installs from github/gh-aw (moved from githubnext/gh-aw).

Summary by CodeRabbit

• Updates
  • Updated automated workflow components to newer versions for improved reliability and compatibility.
  • Enhanced workflow prompt handling, validation, and execution reporting.
  • Added clearer status reporting for processed, cancelled, deferred, skipped, and warning outcomes.
  • Improved agent and threat-detection execution with updated runtime preparation and logging.
  • Refined temporary file and container access handling across automated workflows.