chore(security): minimize AWF agent environment and mask unused gh CLI

Context: runner work for credential-isolated ado-proxy exposed excess AWF agent environment and an unused baked-in gh CLI. This is deferred follow-up; the landing branch already gates ado-proxy and wrapped az on permissions.read. State the invariant that GitHub/Copilot network allowlists and the built-in GitHub MCP must remain unchanged.

Scope sections:
1. Replace Agent and Detection `--env-all` with a one-shot mode-0600 FIFO passed via `--env-file`. Forward only compiler-selected engine config, explicit user engine.env, runtime extension agent env, OTEL file settings, and compiler-owned non-secret context. Do not put secrets in argv or persistent files.
2. Add stable context variables: ADO_AW_ORGANIZATION_URL=$(System.CollectionUri), ADO_AW_PROJECT=$(System.TeamProject), ADO_AW_PROJECT_ID=$(System.TeamProjectId), ADO_AW_REPOSITORY=$(Build.Repository.Name), ADO_AW_REPOSITORY_ID=$(Build.Repository.ID), ADO_AW_BUILD_ID=$(Build.BuildId). Align policy advisory and smokes to `$ADO_AW_*`; no runtime-import prompt should rely on unexpanded `$(System.*)`/`$(Build.*)` text.
3. Route Copilot auth through AWF's API proxy using host-only `COPILOT_GITHUB_TOKEN` (or the GitHub App token when configured), removing `API proxy enabled but no API keys found in environment`. The real model token must not enter agent env, argv, mounts, or process-visible inputs.
4. Mask baked-in `/usr/bin/gh` with a compiler-owned read-only blocked-command mount. This concerns only the gh CLI: retain GitHubExtension, `--allow-tool github`, and all existing GitHub/Copilot hosts.
5. Retain auditable policy-derived feedback: topology/CA preflight, durable lifecycle and sanitized decision logs, machine-readable denial reasons.

Acceptance criteria:
- Generated Agent and Detection AWF commands contain no `--env-all`.
- A sentinel host variable and raw SYSTEM_TEAMPROJECT are absent inside the agent; selected ADO_AW_PROJECT is present.
- AWF logs show Copilot API proxy configured without the no-keys warning; Copilot completes; no real model token is agent-visible.
- Both `gh` and `/usr/bin/gh` fail with an actionable blocked message, without breaking Copilot or GitHub MCP.
- Smoke prompts use `$ADO_AW_*`, never raw ADO macro text, and no longer inspect broad SYSTEM_/BUILD_ environment.
- Existing ado-proxy candidate smoke remains green for allowed wrapped-az reads, ADO MCP read, four denials, proof tag, and parent orchestration.

Runner evidence links:
- https://dev.azure.com/msazuresphere/AgentPlayground/_build/results?buildId=629969
- https://dev.azure.com/msazuresphere/AgentPlayground/_build/results?buildId=629992
- https://dev.azure.com/msazuresphere/AgentPlayground/_build/results?buildId=630006
- https://dev.azure.com/msazuresphere/AgentPlayground/_build/results?buildId=630018
- https://dev.azure.com/msazuresphere/AgentPlayground/_build/results?buildId=630028
Explain briefly: 629969 found attached-container lifecycle failure; 629992 proved detached lifecycle and found CA mode; 630006 proved CA fix and wrapped az while finding MCP query drift; 630018 proved allowed az/MCP reads; 630028 proved allowed reads plus exact denials and Stage 3 proof.

Stop conditions:
- Removing --env-all would require a secret in argv or persistent file.
- Pinned AWF cannot authenticate Copilot via COPILOT_GITHUB_TOKEN.
- Any path exposes raw host az while ado-proxy is disabled/unhealthy.
- Masking /usr/bin/gh breaks Copilot model auth or built-in GitHub MCP, indicating an undocumented dependency.

Start with the generated Agent and Detection AWF commands and the compiler-owned environment handling described in the scope. Run the existing ado-proxy candidate smoke and compare its policy-derived logs with the listed runner evidence. Done means all acceptance criteria pass without changing GitHub/Copilot allowlists, GitHub MCP behavior, or allowed wrapped-az and ADO MCP reads.

Written by the indexing model from the issue text.