Add fast-fail Copilot CLI startup diagnostic step

[Copilot]

Copilot CLI 0-turn startup failures are the dominant production failure family — workflows burn 10-24 minutes of agent work before the failure surfaces. This adds a lightweight preflight step that probes CLI readiness upfront and fails in seconds with an actionable diagnosis.

New step: Probe Copilot CLI readiness

Inserted before Execute GitHub Copilot CLI in standard mode (skipped for engine.command and engine.copilot-sdk: true). Checks:

1. Binary availability — command -v copilot
2. Version health — copilot --version
3. Auth credentials — COPILOT_GITHUB_TOKEN non-empty (skipped in BYOK mode when COPILOT_PROVIDER_BASE_URL is set, or copilot-requests mode when S2STOKENS=true)

On failure, exits non-zero and writes a categorized error (binary / version / auth) to $GITHUB_STEP_SUMMARY.

- name: Probe Copilot CLI readiness
  id: copilot_startup_check
  env:
    COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
    S2STOKENS: "..."
    COPILOT_PROVIDER_BASE_URL: "..."
  run: |
    # checks binary, version, and auth — emits diagnosis to $GITHUB_STEP_SUMMARY on failure

Changes

• copilot_engine_execution.go — added copilotStartupDiagnosticScript, buildCopilotStartupDiagnosticStep(), and updated GetExecutionSteps() to prepend the diagnostic for standard mode
• Test files — updated 9 test files to expect 2 steps (diagnostic + execution) for standard-mode Copilot; SDK and custom-command tests unchanged (still 1 step)
• threat_detection_test.go — tightened wantNotContains check to use 6-space-indented permission form, since the diagnostic script now embeds the string copilot-requests: write in a comment
• Golden files + lock files — regenerated via make update-wasm-golden and make recompile