chore(deps): bump gh-aw toolchain to v0.68.7 + pydantic 2.13.2

[microsasa]

Mega bump that replaces four churn Dependabot PRs with a single coherent upgrade preserving the lock-file + compile invariants.

What this does

actions-lock.json

• actions/github-script@v9: 373c709c → 3a2844b7 (latest v9)
• github/gh-aw-actions/setup: v0.68.3 → v0.68.7 (f5280288)

Compiled .lock.yml (regenerated via gh aw compile at v0.68.7)

• 9 workflow files regenerated with new SHA pins
• Compiler v0.68.3 → v0.68.7
• Firewall images 0.25.20 → 0.25.23; mcpg v0.2.19 → v0.2.22
• New v0.68.7 safety features: base-branch preservation, expanded protected_files, agent config folder handling

copilot-setup-steps.yml (manual workflow)

• github/gh-aw/actions/setup-cli: v0.68.1 → v0.68.7 — resolves pre-existing version skew

pyproject.toml + uv.lock

• pydantic >=2.13.0 → >=2.13.2

dependabot.yml

• Ignore github/gh-aw-actions/* and actions/github-script — these are embedded in compiled .lock.yml files. Updates must go through actions-lock.json + recompile, not direct edits. This stops the churn PRs.

Security payload (v0.68.4 → v0.68.7)

• XPIA sanitization
• Cache-memory planted executable fix
• Steganographic injection fix
• Safe-output injection hardening (homoglyphs, NFKC, heredoc, protocol-relative URLs)

Why not just merge the Dependabot PRs?

They each had fatal problems:

• build(deps): Bump github/gh-aw-actions from ba90f2186d7ad780ec640f364005fa24e797b360 to abea67e08ee83539ea33aaae67bf0cddaa0b03b5 #1018 (gh-aw-actions SHA bump): bumps to an untagged commit that's semantically still v0.68.3 — not a real upgrade, and edits compiled .lock.yml files directly.
• build(deps): Bump actions/github-script from 373c709c69115d41ff229c7e5df9f8788daa9553 to 3a2844b7e9c422d3c10d287c895573f7108da1b3 #1020 (github-script SHA bump): edits compiled .lock.yml files directly; next gh aw compile would revert.
• build(deps): Bump github/gh-aw from 0.68.1 to 0.68.3 #1019 (gh-aw 0.68.1 → 0.68.3): correct target file but wrong version — v0.68.7 is latest.
• build(deps): Update pydantic requirement from <3,>=2.13.0 to >=2.13.2,<3 #1017 (pydantic): fine on its own but included here for atomicity.

Verification

• All SHAs verified via GitHub API (annotated tag peeling where applicable)
• gh aw compile idempotent — re-running produces no diff
• No tag-only @v refs remain in any workflow
• uv lock regenerated cleanly

Issue linkage

Closes #1017
Closes #1018
Closes #1019
Closes #1020
Closes #1021
Refs #92 (meta audit — do NOT close)

[Copilot]

Pull request overview

This PR consolidates multiple dependency bumps by upgrading the gh-aw GitHub Actions toolchain to v0.68.7 (and recompiling the generated *.lock.yml workflows accordingly), while also updating the Python dependency floor for pydantic to >=2.13.2.

Changes:

• Bump gh-aw toolchain pins (including github/gh-aw-actions/setup and actions/github-script) and recompile the generated workflow lock files.
• Update the manual copilot-setup-steps.yml workflow to install gh-aw v0.68.7 (removing prior version skew).
• Update pyproject.toml (and lockfile) to require pydantic>=2.13.2,<3, and adjust Dependabot ignores to avoid churn on compiled workflow pins.

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
pyproject.toml	Bumps pydantic minimum version to 2.13.2.
.github/aw/actions-lock.json	Updates the authoritative SHA pins for actions/github-script@v9 and github/gh-aw-actions/setup@v0.68.7.
.github/dependabot.yml	Adds ignore rules intended to prevent Dependabot churn for compiled workflow action pins.
.github/workflows/copilot-setup-steps.yml	Updates the gh-aw setup action + version to v0.68.7 for the manual setup workflow.
.github/workflows/test-analysis.lock.yml	Recompiled lock workflow with v0.68.7 pins and new safety/runtime script changes.
.github/workflows/quality-gate.lock.yml	Same as above for the quality gate workflow.
.github/workflows/perf-analysis.lock.yml	Same as above for performance analysis workflow.
.github/workflows/perf-agent-improver.lock.yml	Same as above for perf agent improver workflow.
.github/workflows/feature-planner.lock.yml	Same as above for feature planner workflow.
.github/workflows/code-health.lock.yml	Same as above for code health workflow.
.github/workflows/ci-fixer.lock.yml	Same as above for CI fixer workflow, including updated safe-outputs protections list.
.github/workflows/issue-implementer.lock.yml	Recompiled lock workflow with v0.68.7 pins and updated runtime steps.
.github/workflows/review-responder.lock.yml	Recompiled lock workflow with v0.68.7 pins and updated runtime steps.