`gh aw update` rewrites local `imports:` to cross-repo paths that fail at runtime

[johnpreed]

Bug Description

After installing workflows from a remote repository with gh aw add, the imports: frontmatter correctly uses local relative paths (e.g. shared/team-config.md). However, running gh aw update rewrites these to cross-repo paths pinned to a SHA:

# Before gh aw update (correct)
imports:
- shared/team-config.md
- shared/aor-index.md

# After gh aw update (broken)
imports:
- github/identity-core/.github/workflows/shared/team-config.md@cd32c168...
- github/identity-core/.github/workflows/shared/aor-index.md@cd32c168...

At compile time these cross-repo imports download into .github/aw/imports/, which is gitignored by default (added by gh aw init). The files exist locally but are never committed or pushed.

At runtime on GitHub Actions, the runner cannot find them:

ERR_SYSTEM: Runtime import file not found: .github/aw/imports/github/identity-core/.../.github_workflows_shared_team-config.md

Steps to Reproduce

1. Create a library repo (e.g. github/identity-core) with workflows that use shared imports:

   .github/workflows/shared/team-config.md
   .github/workflows/shared/aor-index.md
   .github/workflows/investigate.md  # imports: [shared/team-config.md, shared/aor-index.md]
   

2. In a consuming repo, install:

   gh aw add github/identity-core/.github/workflows/investigate.md

3. Verify imports are local relative paths ✅
4. Copy the shared files locally to .github/workflows/shared/
5. Run gh aw update
6. Observe that imports: are now rewritten to cross-repo SHA-pinned paths
7. Run gh aw compile — compiles fine locally (downloads to .github/aw/imports/)
8. Commit, push, trigger workflow on Actions
9. Failure: ERR_SYSTEM: Runtime import file not found

Expected Behavior

gh aw update should preserve local relative import paths when the shared files already exist in the consuming repo. It should not rewrite them to cross-repo paths.

Workaround

Manually revert all cross-repo import paths back to local relative paths after every gh aw update:

imports:
-- github/identity-core/.github/workflows/shared/team-config.md@cd32c168...
+- shared/team-config.md

References

• Fix PR with all the manual reverts: https://github.com/github/authentication/pull/6396
• Example runtime failure: https://github.com/github/authentication/actions/runs/23817367122/job/69420474331
• Affected workflows: investigate.md, investigate-yolo.md, investigate-on-issue-open.md, accept.md, create-pr.md — all had their local imports for team-config.md, aor-index.md, and issue-investigation-phases.md rewritten to cross-repo paths after update

Environment

• gh-aw version: v0.64.2
• Library repo: github/identity-core
• Consuming repo: github/authentication

[pelikhan]

@copilot add integration test in ci.yml for this scenario. Use githubnext/agentics