[dependabot:release-train-updater] npm registry access blocked for dependency install validation (`@github/copilot-sdk` 1.0.11→1.0.13)

### What changed
- Attempted update: `@github/copilot-sdk` 1.0.11 → 1.0.13 (patch)
- Manifest: `package.json` (root), used in `dashboard/local-server.mjs`
- No known vulnerabilities in current or target version.
- No existing open PR/issue found covering this update.

### Why blocked
`npm install @github/copilot-sdk@1.0.13` fails to complete in this workflow's sandbox. The npm registry root (`https://registry.npmjs.org`) is reachable, but tarball fetches for several transitive dependencies (e.g. `micromark-extension-gfm-tagfilter`, `rehype-stringify`, `micromark-util-encode`) are routed through an internal proxy mirror (`ms-feed-*.pkgs.visualstudio.com`) that returns `403`/`EADDRNOTAVAIL` for those specific packages, causing the install to abort ("Exit handler never called!" npm error). No package.json or lockfile changes were made — the workspace was left clean.

### Smallest remediation
- Allowlist/whitelist the `ms-feed-*.pkgs.visualstudio.com` npm proxy mirror (or the direct `registry.npmjs.org` tarball paths) for the dependency-update workflow's network policy, OR
- Run this specific update manually/locally where full registry egress is available, then open a PR with the resulting `package.json`/`package-lock.json` diff.

### Validation
- Commands run: `npm outdated`, `github-check_dependency_vulnerabilities` (0 vulnerabilities), `npm install @github/copilot-sdk@1.0.13` (failed, retried 4x with cleanup between attempts)
- Result: install could not complete due to registry/proxy network restriction
- Remaining gaps: cannot validate a working lockfile change without registry access

### Control Plane
- Correlation ID: 34045365345-424
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34045365345

> [!WARNING]
>
> Firewall blocked 4 domains
>
> The following domains were blocked by the firewall during workflow execution:
>
> - `msfeed12.pkgs.visualstudio.com`
> - `msfeed17.pkgs.visualstudio.com`
> - `msfeed2.pkgs.visualstudio.com`
> - `msfeed25.pkgs.visualstudio.com`
>
> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "msfeed12.pkgs.visualstudio.com"
> - "msfeed17.pkgs.visualstudio.com"
> - "msfeed2.pkgs.visualstudio.com"
> - "msfeed25.pkgs.visualstudio.com"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/34045365345) · copilot · auto · 87.3 AIC · ⌖ 11.7 AIC · ⊞ 20.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 20, 2026, 4:53 PM UTC

Start with the root package.json and the dependency-update workflow's network configuration; dashboard/local-server.mjs is the consumer of @github/copilot-sdk. Review the failed npm install and the listed blocked domains, then rerun the update workflow or install command after the network issue is addressed. Done means a validated package.json/package-lock.json update to 1.0.13 with no remaining install errors.

Written by the indexing model from the issue text.