[WIP] Fix firewall binary path for Goose engine job

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>[aw-failures] Smoke Goose: 'awf: command not found' (exit 127) — firewall binary missing from PATH in Goose engine job</issue_title>
<issue_description>Fix the Goose engine's job setup so the awf firewall binary is on PATH before "Execute Goose CLI" runs — right now the step fails immediately with awf: command not found (exit 127), before Goose ever starts.

Affected workflow / run

• Workflow: Smoke Goose (.github/workflows/smoke-goose.lock.yml)
• Failed run: §30880381421, 2026-08-04T05:20:24Z, job 91900536237, step "Execute Goose CLI"

Probable root cause

Full job log (agenticworkflows audit, workflow-logs/4_agent.txt) shows the step's generated shell script directly invoking the firewall wrapper:

awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" ... -- /bin/bash -c '... goose_harness.cjs goose'

which fails immediately with:

.../6f8a89b8-b238-4682-ae53-655d8b85afd3.sh: line 23: awf: command not found
##[error]Process completed with exit code 127.

The awf binary was never installed onto PATH for this job before the step ran — this looks like a step-ordering or PATH-export gap specific to the Goose engine's generated job (the CVE-scan, Claude Code, and Copilot CLI jobs analyzed in this same window did not hit a missing-binary error at this stage).

Proposed remediation

• Diff the Smoke Goose .lock.yml job's steps against a working engine (e.g. Claude Code CLI) to confirm both get the same awf-install/PATH-setup step ahead of CLI execution.
• Ensure awf is installed and placed on PATH before "Execute Goose CLI" runs — fix the PATH export order or missing install step in the workflow codegen for the goose engine specifically.

Success criteria

• command -v awf succeeds inside the Smoke Goose job immediately before "Execute Goose CLI".
• Smoke Goose completes without awf: command not found / exit 127.
  Related to [aw-failures] [aw] Failure Investigator Report — 2026-08-03 (6h) #50077

Generated by 🔍 [aw] Failure Investigator (6h) · agent · 191.6 AIC · ⌖ 37.4 AIC · ⊞ 5.5K · ◷

• expires on Aug 10, 2026, 11:54 PM UTC-08:00

• Closes [aw-failures] Smoke Goose: 'awf: command not found' (exit 127) — firewall binary missing from PATH in Goose engine job #50214

Comments on the Issue (you are @copilot in this section)

• Fixes [aw-failures] Smoke Goose: 'awf: command not found' (exit 127) — firewall binary missing from PATH in Goose engine job #50214