[AIAA] Build step 4: cloud agent environment setup

Build step 4 of the AI-assisted assessment system: the agent's
environment setup.

Deliverable: `.github/workflows/copilot-setup-steps.yml`. It prepares
the cloud agent's ephemeral environment before the model starts: Node
from `.nvmrc` with npm cache and `npm ci`, through the repository's
existing `npm-ci-via-cached-nvmrc` composite action. Minimal on
purpose: the deterministic data-collection scripts join these setup
steps in a later step, once they exist.

The setup steps run outside the agent's firewall, so the reviewed
workflow file is the control over what setup fetches. This change
introduces no secrets and requests read-only contents permission.

The workflow triggers on changes to itself, so the PR that adds it
shows a green run before merge. It only takes effect for agent
sessions once merged to the default branch.

Done when an agent session's logs show the prepared environment.

- [ ] Tracking issue opened (this issue)
- [ ] Draft verified locally (assertion script green, `npm run check`
passes)
- [ ] PR opened; setup workflow runs green on the PR itself
- [ ] Merged
- [ ] Agent session logs show the prepared environment (probe #366 or
first delegated session)