Suggested test: copilot/network-engine-domain-explicit-opt-in

## Motivation

Link to the gh-aw PR: github/gh-aw#56447 — "Make engine domain sets explicit opt-in"

Compiler no longer auto-merges agent engine domain sets (e.g. `copilot`, `claude`, `codex`) into firewall allow-lists; workflows must reference them explicitly in `network.allowed`, like `defaults`/other domain sets. No existing test in `existing-tests.json` exercises `network.allowed` domain-set resolution or firewall behavior when the engine domain set is omitted vs included.

## Proposed test

- **Workflow file**: `test-copilot-network-engine-domain-opt-in.md`
- **Trigger**: `workflow_dispatch`
- **Engine**: copilot
- **Safe output**: `create-issue`
- **Variant**: standard

## Minimal test prompt sketch

Configure `network: { allowed: [defaults, copilot] }` explicitly in frontmatter, then have the agent make a trivial network-dependent action (or just report success) and create an issue confirming the firewall allowed the copilot domain set — verifying the explicit opt-in resolves correctly post-compile.

## New fixtures or secrets needed

None — reuses `githubnext/gh-aw-test`.

## Notes

Existing `test-copilot-network-isolation.md` tests default sandboxing/isolation but does not exercise the new explicit `network.allowed` engine-domain-set opt-in behavior. Worth confirming via `gh aw compile` that the lockfile firewall config differs based on whether `copilot` is listed.

> Generated by [🔍 Suggest New E2E Tests](https://github.com/githubnext/gh-aw-test/actions/runs/33170338931) · copilot · auto · 22.6 AIC · ⌖ 3.81 AIC · ⊞ 8.8K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-test+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-test%2Fsuggest-new-e2e-tests%22&type=issues)

Start with the proposed test-copilot-network-engine-domain-opt-in.md and compare it with test-copilot-network-isolation.md. Run gh aw compile for workflows with and without copilot in network.allowed, then inspect the lockfile firewall configuration. Done means the explicit copilot domain set resolves and the test confirms the expected firewall behavior without new fixtures or secrets.

Written by the indexing model from the issue text.