[aw-compat] Daily compat report 2026-04-27: 3/20 repos fail (serena import + env secrets)

### Overview

Daily compatibility audit run against the top 20 public repositories using gh-aw lock files.
gh-aw binary: `v6dea27e` (built from main, 2026-04-27)

| Metric | Value |
|--------|-------|
| Repositories audited | 20 |
| Passed (compile after fix) | **17** ✅ |
| Failed (compile after fix) | **3** ❌ |
| Fix changes applied | 20 repos (lock file updates, serena migration) |
| Distinct error clusters | 2 |

### Failed Repositories

| Repository | Stars | Root Cause |
|-----------|-------|-----------|
| [storybookjs/storybook](https://github.com/storybookjs/storybook) | 89,805 | Incomplete serena import migration — missing required `languages` param |
| [microsoft/FluidFramework](https://github.com/microsoft/FluidFramework) | 4,921 | Incomplete serena import migration — missing required `languages` param |
| [Azure/azure-rest-api-specs](https://github.com/Azure/azure-rest-api-specs) | ~5k | Strict mode: `secrets.GITHUB_PERSONAL_ACCESS_TOKEN` in `env` section |

### Error Cluster 1: Incomplete serena Migration (2 repos)

`gh aw fix --write` migrated `tools: [serena]` → `imports:` syntax, but the serena import schema requires a mandatory `languages` parameter that was not populated. The fix left workflows in a broken state.

**Error:**
```
import 'github/gh-aw/.github/workflows/shared/mcp/serena.md@main':
required 'with' input "languages" is missing (declared in import-schema)
```

**Manual fix needed in workflow:**
```yaml
imports:
- github/gh-aw/.github/workflows/shared/mcp/serena.md@main
with:
languages: "TypeScript,JavaScript"
```

See issue `#28700` for the codemod proposal.

### Error Cluster 2: Secrets in `env` Section (1 repo)

`Azure/azure-rest-api-specs` uses `$\{\{ secrets.GITHUB_PERSONAL_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}` directly in the `env` block, which strict mode rejects because it leaks the token into the agent container.

**Error:**
```
strict mode: secrets detected in 'env' section will be leaked to the agent container.
Found: $\{\{ secrets.GITHUB_PERSONAL_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
Use engine-specific secret configuration instead.
```

**Manual fix needed:**
```yaml
engine: copilot
secrets:
- GITHUB_PERSONAL_ACCESS_TOKEN
```

### Fix Changes Applied Across Passing Repos

`gh aw fix --write` ran cleanly on all 20 repos and applied:
- Lock file regeneration with updated container images (0.25.20 → 0.25.28)
- Removed deprecated `compiler_version` field from lock file metadata
- Updated `github/gh-aw-actions/setup` → `actions/setup-node` in lock manifests
- Security-pinned container image digests added

View all 20 repositories and results

| # | Repository | Stars | Clone | Before | After | Changed Files |
|---|-----------|-------|-------|--------|-------|---------------|
| 1 | f/prompts.chat | 160,859 | ✅ | 0 | 0 | 1 |
| 2 | clash-verge-rev/clash-verge-rev | 113,832 | ✅ | 0 | 0 | 1 |
| 3 | storybookjs/storybook | 89,805 | ✅ | 1 | **1** ❌ | 4 |
| 4 | appwrite/appwrite | 55,888 | ✅ | 0 | 0 | 1 |
| 5 | dotnet/aspnetcore | 37,871 | ✅ | 0 | 0 | 5 |
| 6 | BabylonJS/Babylon.js | 25,429 | ✅ | 0 | 0 | 2 |
| 7 | taosdata/TDengine | 24,837 | ✅ | 0 | 0 | 3 |
| 8 | dotnet/maui | 23,238 | ✅ | 0 | 0 | 4 |
| 9 | dotnet/runtime | 17,847 | ✅ | 0 | 0 | 4 |
| 10 | Z3Prover/z3 | 12,196 | ✅ | 0 | 0 | 17 |
| 11 | openvinotoolkit/openvino | 10,141 | ✅ | 0 | 0 | 1 |
| 12 | dotnet/machinelearning | 9,328 | ✅ | 0 | 0 | 5 |
| 13 | microsoft/FluidFramework | 4,921 | ✅ | 1 | **1** ❌ | 5 |
| 14 | apache/cloudstack | 2,878 | ✅ | 0 | 0 | 2 |
| 15 | Azure/azure-sdk-for-net | ~5k | ✅ | 0 | 0 | 2 |
| 16 | Azure/azure-rest-api-specs | ~5k | ✅ | 1 | **1** ❌ | 1 |
| 17 | ReactiveX/RxPY | ~5k | ✅ | 0 | 0 | 1 |
| 18 | stdlib-js/stdlib | ~4k | ✅ | 0 | 0 | 2 |
| 19 | PowerShell/vscode-powershell | ~4k | ✅ | 0 | 0 | 1 |
| 20 | dotnet/android | ~3k | ✅ | 0 | 0 | 1 |

**References:** [§24991840104](https://github.com/github/gh-aw/actions/runs/24991840104)