Restore shell-capable engines for recurring workflows

[pelikhan]

Summary

Switch Daily Go Test Parallelizer, Daily CLI Performance, Issue Triage and PureLock from Codex to Copilot CLI while preserving GitHub inference, model selections, authored permissions, sandbox/network settings and safe-output contracts. Regenerate their locks, add a shell-capability regression test and document the Codex/GitHub CLI-transport limitation.

GitHub-provider Codex deliberately disables native shell execution to avoid unsupported custom tools, with no MCP shell fallback. Declaring tools.bash cannot restore it. These workflows need local commands or shell-based CLI transport. This applies the existing Avenger correction from #67411 without changing the compatibility guard or fabricating successful outputs.

Addresses the demonstrated capability defect underlying #68025, #68009, #68031, #68028 and sibling-transferred #68008. These references intentionally do not auto-close reports: live completion is unverified.

Evidence

• Parallelizer runs 38265099492 and 38253277728 and CLI Performance run 38267099992 each recorded one native Codex completed turn, zero native tool items and zero safe-output gateway calls. Gateway registration is not proof of CLI execution capability.
• Issue Triage run 38266158549 recorded native MCP activity, but its configured CLI-proxy safe-output transport requires unavailable shell execution.
• PureLock run 38252996289 recorded MCP activity and a missing-tool diagnostic; its test work requires declared local shell execution.
• All assigned runs predate Add privacy-preserving completion evidence to failure reports #68003's 2026-10-12 15:44 UTC merge and use Codex 0.162.1 / AWF v0.28.51. They do not test that later diagnostics fix. The migrated locks use Copilot 1.0.95 with the same AWF pin.

Only structural observations, static statuses and counts are reported here; no raw payloads, secrets, prompts or agent prose.

Validation

• Current main 7eea6a06dd merged; only the four intended source/lock pairs, regression and documentation differ from it.
• Build, focused shell-capability/compatibility tests, Go lint, custom Go lint, schema checks and impacted Go tests passed. Production lock assertions confirm retained models, Copilot launch, shell grants and pinned AWF.
• make recompile compiled all 338 workflows. After incorporating merged Regenerate stale Claude routed smoke workflow lock #68053, the change-scoped pre-PR gate and full workflow drift check passed; earlier smoke-lock drift was stale branch baseline, not a remaining issue.
• Read-only source/normal-lock security reconciliation, including the post-merge generated delta, found no vulnerabilities.
• Production actionlint comparison on the initial base: 29 baseline errors vs 17 candidate errors, with no introduced error signatures. Remaining errors are existing concurrency.queue syntax and needs.activation expressions. Production zizmor comparison: 43 baseline findings vs 35 candidate findings; remaining low-severity self-repository and obfuscation categories match baseline; adhoc-packages findings were removed.

Diagnostic dry-run gate failed, despite emitting four diagnostic .lock.yml artifacts preserved privately and restoring normal production locks. Shellcheck and poutine passed; actionlint and zizmor failed. Dry-run actionlint reports empty top-level env, references to removed daily-credit activation outputs, and constant if: false conditions. Zizmor additionally reports secrets-outside-env in generated diagnostic workflows. These are not represented as passed or suppressed, and no live execution approval is claimed. The repository-wide formatter also encountered an existing JSON formatter convertToJson error; changed Go formatting and the change-scoped gate passed, and incidental formatting changes were excluded.

Remaining reports

#68023 (Daily Fact, run 38263325499) and #68019 (Workflow Normalizer, run 38254210736) failed Start MCP Gateway with execution state not_started; they are distinct startup failures, not silent Codex invocations. They remain unresolved and unchanged. No nonzero-driver reporting changes duplicate #68001. No workflow was dispatched, no automatic noop was added, and no reports were closed.

The environment exposes no report_progress tool; validated changes were committed and pushed with Git.