Bump default gh-aw-firewall version to v0.27.11

## Request

Bump the default `gh-aw-firewall` (AWF) version from **`v0.27.10` → `v0.27.11`** and regenerate the pinned workflow artifacts.

Release: https://github.com/github/gh-aw-firewall/releases/tag/v0.27.11
Full changelog: https://github.com/github/gh-aw-firewall/compare/v0.27.10...v0.27.11

## Why

`v0.27.11` ships the two network-isolation (`sandbox.agent.sudo: false`) rollout fixes that block `sudo: false` workflows on standard runners:

- **Topology-attach ordering deadlock** — `awf-cli-proxy` could never become healthy because the external DIFC-proxy/MCP-gateway peers were only attached to `awf-net` *after* startup had already gated on that sidecar's health (`getaddrinfo EAI_AGAIN awmg-cli-proxy` → "firewall failed to start, agent never invoked"). Fixed in github/gh-aw-firewall#5544.
- **Rootless artifact permission regression** — firewall log/audit files were written with UIDs the unprivileged runner couldn't read, causing `EACCES` on `upload-artifact` once the `sudo chmod` workaround was removed. Fixed in github/gh-aw-firewall#5546.

These directly unblock `sudo: false` workflows (e.g. the `glossary-maintainer` revert in github/gh-aw#41426), plus assorted refactors/test-coverage improvements listed in the release notes.

## Changes required

1. **Update the default version constant** — `pkg/constants/version_constants.go:76`:
```go
const DefaultFirewallVersion Version = "v0.27.11"
```
2. **Run the documented rebuild + double-recompile** (per the warning comment at `version_constants.go:70-75`):
```sh
make build && make recompile && make recompile
```
The first recompile regenerates all `*.lock.yml` using the new version; the second refreshes the container SHA pins resolved during the first pass.
3. **Refresh `.github/aw/actions-lock.json`** — the recompile resolves the new `agent`/`api-proxy`/`squid:0.27.11` pinned image digests (replacing the `0.27.10` entries around lines 245/325/470).
4. **Add a changeset** — `.changeset/patch-bump-awf-v0-27-11.md`, matching the existing pattern:
```md
---
"gh-aw": patch
---

Bump the default gh-aw-firewall version to v0.27.11 and regenerate pinned workflow artifacts.
```

> Note: this is a firewall-only bump — `DefaultGitHubMCPServerVersion` / `gh-aw-mcpg` are unchanged unless a coupled bump is intended.

## Acceptance criteria

- `DefaultFirewallVersion == "v0.27.11"`.
- All regenerated `*.lock.yml` reference `gh-aw-firewall/{agent,api-proxy,squid}:0.27.11` with refreshed SHA pins.
- `.github/aw/actions-lock.json` contains `0.27.11` pinned-image digests.
- Changeset added.
- `make build` and the test suite pass.