[dependabot:release-train-updater] Update `@github/copilot-sdk` 1.0.11 → 1.0.13 blocked by registry 403

## Dependency Release Train Summary

### What changed (attempted)
- Package/ecosystem: npm — `@github/copilot-sdk`
- Manifest(s): `package.json`, `package-lock.json`
- Old version: `1.0.11`
- New version: `1.0.13` (latest per npm registry, no pre-release)
- Update type: patch

### Why now
- Routine freshness check (round 1): `npm outdated` showed `@github/copilot-sdk` is 2 patch versions behind. `npm audit` reported zero known vulnerabilities in the current dependency tree — this is not a security-driven update.

### Risk assessment
- Runtime/dev/build/CI scope: runtime (dynamically imported in `dashboard/local-server.mjs` for `--copilot` mode)
- Direct/transitive: direct dependency
- Reachability: confirmed via `import("@github/copilot-sdk")` in `dashboard/local-server.mjs` (also mirrored in `target/dashboard/local-server.mjs`, not edited)

### Validation
- Commands run: `npm install @github/copilot-sdk@1.0.13 --save`
- Result: **failed** — `npm error code E403` fetching a transitive dependency (`@ungap/structured-clone@1.3.3`) from the sandbox's internal npm proxy (`ms-feed-*.pkgs.visualstudio.com`), which returned `403 Forbidden`. No files were modified; working tree was left clean.
- Remaining gaps: this sandbox's npm registry mirror does not currently resolve all packages needed to complete the install. Retrying did not help (same registry mirror, same result) and is out of scope for this run.

### Control Plane
- Correlation ID: 33971619932-301
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33971619932

### Sensitive surface area
None — this is a non-security patch bump.

### Recommended next step
Re-run this workflow once the CI/agent npm registry proxy issue for `ms-feed-*.pkgs.visualstudio.com` is resolved, or run `npm install @github/copilot-sdk@1.0.13 --save` locally/manually where full registry access is available, then open a PR with the resulting `package.json`/`package-lock.json` diff.

### Rollback guidance
Not applicable — no changes were made to the repository.

> [!WARNING]
>
> Firewall blocked 4 domains
>
> The following domains were blocked by the firewall during workflow execution:
>
> - `msfeed12.pkgs.visualstudio.com`
> - `msfeed17.pkgs.visualstudio.com`
> - `msfeed2.pkgs.visualstudio.com`
> - `msfeed25.pkgs.visualstudio.com`
>
> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "msfeed12.pkgs.visualstudio.com"
> - "msfeed17.pkgs.visualstudio.com"
> - "msfeed2.pkgs.visualstudio.com"
> - "msfeed25.pkgs.visualstudio.com"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/33971619932) · copilot · auto · 56 AIC · ⌖ 13 AIC · ⊞ 20.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 19, 2026, 2:32 PM UTC

Start with package.json and package-lock.json, then review the dynamic import in dashboard/local-server.mjs to confirm the dependency's runtime use. Run npm install @github/copilot-sdk@1.0.13 --save where the registry is accessible. Done means both manifest files contain the requested version and the resulting change can be validated before opening a PR.

Written by the indexing model from the issue text.