Ensure Copilot bootstrap can find Node.js inside AWF chroot

[Copilot]

Copilot-engine workflows were failing before inference because node was not available inside the chrooted agent environment (node: command not found). The failure path had no turns/tool calls, so startup needed a deterministic runtime fix and clearer diagnostics.

• Node runtime visibility in chroot

  • Added ~/.nvm to agent bind mounts so nvm-managed Node installs are available in /host chroot.
  • Added ~/.nvm to pre-created allowed home subdirectories to avoid root-owned auto-created mount sources.

• Fail-fast bootstrap guard for Copilot

  • Added AWF_REQUIRE_NODE signal in compose generation when the invoked executable is copilot (or Copilot auth env is configured).
  • Added an entrypoint preflight check gated by AWF_REQUIRE_NODE:
    • validates node is resolvable in chroot before running the user command
    • exits with a targeted, actionable error instead of a generic shell failure

• Targeted test coverage

  • Extended docker-manager tests to validate:
    • .nvm mount inclusion
    • .nvm pre-creation
    • AWF_REQUIRE_NODE set for Copilot invocations and unset for non-Copilot commands

const commandExecutable = config.agentCommand.trim().split(/\s+/, 1)[0] || '';
const commandExecutableBase = path.posix.basename(commandExecutable.replace(/\\/g, '/'));
const isCopilotCommand = commandExecutableBase.toLowerCase() === 'copilot';
if (config.copilotGithubToken || config.copilotApiKey || isCopilotCommand) {
  environment.AWF_REQUIRE_NODE = '1';
}