Fix Update Astro model and safe-output fallback

[Copilot]

The Update Astro workflow was completing without safe outputs after the Codex agent hit an unsupported model/runtime path. The workflow also lacked clear terminal-output guidance for infrastructure/tooling failures.

• Model/runtime configuration
  • Move Codex execution to the OpenAI model path.
  • Provision Node 24 for the agent runtime.
  • Select the AWF sandbox agent explicitly.

engine:
  id: codex
  model-provider: openai
model: openai/gpt-5.4

runtimes:
  node:
    version: "24"

sandbox:
  agent:
    id: awf
    runtime: cloud-hypervisor

• Safe-output completion path
  • Clarify that successful dependency updates must use create_pull_request.
  • Require noop when no update is needed or a docs build failure cannot be safely fixed.
  • Use the registered missing_tool output when infrastructure/tooling prevents meaningful work.

• Fixes [aw] Update Astro produced no safe outputs #58904