[dependabot:release-train-updater] Sandbox npm install blocked by ms-feed mirror in package-lock.json (blocks astro/copilot-sdk patch bump)

## Dependency Release Train — Blocked by sandbox npm registry mirror

### Candidate identified (safe, low-risk, ready once unblocked)
Root `package.json` patch bump in `githubnext/gh-aw-cao`:
- `astro` 7.3.1 → 7.3.2
- `@astrojs/markdown-remark` 7.3.0 → 7.3.1 (peerDependency `^astro 7.3.0`, compatible)
- `@github/copilot-sdk` 1.0.11 → 1.0.13 (used directly in `dashboard/local-server.mjs`)

All three versions verified available via `npm view @ version --registry https://registry.npmjs.org/` (direct network call succeeds; `registry.npmjs.org` is reachable). No open PR or issue references these package bumps.

### Why no PR was opened this run
`npm install` cannot complete in this sandbox environment:

1. `package-lock.json` contains 154 `resolved` entries pinned to internal Azure DevOps mirror hosts (`ms-feed-*.pkgs.visualstudio.com`), which return `403 Forbidden` / `EADDRNOTAVAIL` from this sandbox even though `registry.npmjs.org` itself is directly reachable (`curl` returns `200`).
2. Independently, the npm CLI (`npm v10.9.8`, Node `v22.23.2`) intermittently crashes with its own internal `Exit handler never called!` bug during installs, unrelated to network reachability.

Both failure modes were reproduced again in this run (foreground, `--ignore-scripts`), consistent with cache-memory history describing this exact blocker recurring since 2026-09-06 across 10+ runs targeting this repository (and others in the fleet). No file changes were made — `package.json`/`package-lock.json` are unchanged and the working tree was fully restored (`node_modules` removed, no branch created).

### Recommended remediation
- Regenerate `package-lock.json` once, from an environment where `npm install` succeeds cleanly, so all `resolved` URLs point to `registry.npmjs.org` instead of the `ms-feed-*.pkgs.visualstudio.com` mirror. This should be a one-time fix that unblocks all future dependency-update runs against this manifest.
- Alternatively, allow outbound access to `ms-feed-*.pkgs.visualstudio.com` from the agent sandbox network policy, if that mirror is intentionally used as a build-time npm proxy.
- Do not hand-edit `resolved` URLs in `package-lock.json` — this was attempted in a prior run and caused long hangs with zero progress.

### Next steps once unblocked
Retry: `npm install astro@7.3.2 @astrojs/markdown-remark@7.3.1 @github/copilot-sdk@1.0.13 --save-exact`, validate, and open the dependency-bump PR.

### Control Plane
- Correlation ID: 34416370686-170
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34416370686

> [!WARNING]
>
> Firewall blocked 4 domains
>
> The following domains were blocked by the firewall during workflow execution:
>
> - `msfeed12.pkgs.visualstudio.com`
> - `msfeed17.pkgs.visualstudio.com`
> - `msfeed2.pkgs.visualstudio.com`
> - `msfeed25.pkgs.visualstudio.com`
>
> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "msfeed12.pkgs.visualstudio.com"
> - "msfeed17.pkgs.visualstudio.com"
> - "msfeed2.pkgs.visualstudio.com"
> - "msfeed25.pkgs.visualstudio.com"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/34416660455) · copilot · auto · 66 AIC · ⌖ 9.77 AIC · ⊞ 18K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 23, 2026, 11:34 PM UTC

Start with the root package.json and package-lock.json, then reproduce the npm install failure using the exact retry command in the issue. Verify that installation completes in an environment with the required registry access, the three requested versions are recorded, and validation passes before opening the dependency-bump PR.

Written by the indexing model from the issue text.