[WIP] Use AWF --enable-chroot mode and remove unnecessary flags

[Copilot]

Thanks for assigning this issue to me. I'm starting to work on it and will keep this PR's description up to date as I form a plan and make progress.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Use AWF --enable-chroot mode and remove unnecessary --mount and --env flags</issue_title>
<issue_description>## Summary

Adopt the new --enable-chroot feature from AWF v0.13.1 to simplify the generated workflow commands by removing unnecessary --mount and --env flags.

Background

AWF v0.13.1 introduced --enable-chroot mode which provides transparent access to host binaries (Python, Node.js, Go, etc.) while maintaining network isolation. This eliminates the need for explicit volume mounts and environment variable passthrough since the chroot environment has direct access to the host filesystem.

Blocked By

• Update AWF (gh-aw-firewall) to v0.13.1 #13376 (Update AWF to v0.13.1)

Changes Required

1. Add --enable-chroot flag to AWF invocations in the workflow generator
2. Remove unnecessary --mount flags that were previously needed to expose host binaries/paths
3. Remove unnecessary --env flags that were previously needed to pass environment variables (chroot inherits host environment)

Benefits

• Simpler generated workflow commands
• Reduced configuration complexity
• Better compatibility with host tools and environments
• Cleaner workflow YAML output

Documentation

• Chroot mode docs: https://github.com/github/gh-aw-firewall/blob/main/docs/chroot-mode.md</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Use AWF --enable-chroot mode and remove unnecessary --mount and --env flags #13379

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.