Suggested test: copilot/network-npm-registry-allowlist

## Motivation

github/gh-aw#56592 — Add npm registry allowlist to affected workflows, part of ongoing sandbox/network egress allowlisting work (related also to #56653 "Preserve GitHub expression operators in safe-output JSON").

## Proposed test

- **Workflow file**: `test-copilot-network-npm-registry-allowlist.md`
- **Trigger**: `workflow_dispatch`
- **Engine**: copilot
- **Safe output**: `create-issue`
- **Variant**: standard (sandboxed, so the network allowlist is actually enforced)

## Minimal test prompt sketch

Configure the workflow's `network` frontmatter to allow the npm registry domain, have the agent run `npm view version` (or similar registry read) inside its sandbox, and create an issue reporting the fetched version — proving the npm registry allowlist entry permits the request while other unlisted domains remain blocked (as already covered by `test-copilot-network-isolation.md` for the deny path).

## New fixtures or secrets needed

None — npm registry is a public read-only endpoint.

## Notes

Existing `test-copilot-network-isolation.md` only proves egress isolation broadly; it doesn't exercise a specific configured allowlist domain like the npm registry. This complements it. Confirm gh-aw's `network:` frontmatter syntax for domain allowlisting before writing the compilable source (may need to check current allowed-domains list format, e.g. `ecosystems: [node]` vs explicit domain).

> Generated by [🔍 Suggest New E2E Tests](https://github.com/githubnext/gh-aw-test/actions/runs/33243402461) · auto · 27.6 AIC · ⌖ 1.9 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-test+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-test%2Fsuggest-new-e2e-tests%22&type=issues)

Start with test-copilot-network-isolation.md and confirm the current gh-aw network frontmatter syntax for domain allowlisting. Add test-copilot-network-npm-registry-allowlist.md with workflow_dispatch, the copilot engine, standard sandboxing, and create-issue safe output. Done means npm view can read the npm registry while unlisted domains remain blocked, with no fixtures or secrets required.

Written by the indexing model from the issue text.