Bump gh-aw to v0.75.0 to fix workflow_install_note ENOENT

[Evangelink]

Fixes #8504.

Problem

The Code Simplifier workflow (and any other agentic workflow that emits create_pull_request or create_issue safe outputs) crashes in the Process Safe Outputs step with:

ENOENT: no such file or directory, open '/home/runner/work/_temp/gh-aw/md/workflow_install_note.md'

Because this is classified as a code push failure, all subsequent safe outputs are cancelled, so the workflow produces nothing despite the agent succeeding (run 26291858477).

Root cause (upstream)

gh-aw v0.74.8 ships actions/setup/js/messages_footer.cjs that resolves the install-note template via path.join(__dirname, '../md/workflow_install_note.md') instead of the runtime \/gh-aw/prompts/ directory where setup.sh actually stages the prompts.

• Upstream issue: Process Safe Outputs crashes with ENOENT on workflow_install_note.md, blocking all PR/issue creation github/gh-aw#33981
• Upstream fix: fix: resolve workflow_install_note.md ENOENT in safe_outputs job github/gh-aw#33654 (uses getPromptPath() like the other handlers; shipped in pre-release v0.75.0)

Fix in this repo

Recompiled the 28 agentic workflows with gh aw compile --strict using gh-aw v0.75.0. This bumps every github/gh-aw-actions/setup{,-cli} reference from v0.74.8 (SHA efa55847) to v0.75.0 (SHA f889c9c3), which contains the patched messages_footer.cjs. Container image tags also bump alongside (gh-aw-firewall 0.25.49 → 0.25.51, gh-aw-mcpg v0.3.9 → v0.3.17, github-mcp-server v0.32.0 → v1.0.4).

To keep actions SHA-pinned per strict mode (the cli can't reach github/gh-aw-actions from a SAML-restricted environment), I pre-populated .github/aw/actions-lock.json with the new SHAs and ghcr.io digests before recompiling so the lock files keep the @<sha> # <tag> form.

Verification

gh aw compile --strict
# -> Compiled 28 workflow(s): 0 error(s), 5 warning(s)

The 5 warnings are pre-existing (3 deprecated title-prefix notes, 1 automatic env-var extraction in issue-arborist, 1 centralized slash-command suggestion).

[Copilot]

Pull request overview

This PR updates the repo’s agentic workflow runtime to gh-aw v0.75.0 to resolve the safe-outputs crash (workflow_install_note.md ENOENT) affecting workflows that emit create_pull_request / create_issue outputs.

Changes:

• Recompiled gh-aw lock workflows to bump github/gh-aw-actions/setup{,-cli} to v0.75.0 (SHA f889c9c3…) and update associated container image pins/digests.
• Updated the generated agentics maintenance workflow to use gh-aw v0.75.0.
• Updated .github/aw/actions-lock.json with the new gh-aw action SHAs and container digests so strict compilation remains SHA-pinned.

Show a summary per file

File	Description
.github/workflows/sub-issue-closer.lock.yml	Regenerated lock workflow with gh-aw v0.75.0 action + updated container pins.
.github/workflows/msbuild-quality-review.lock.yml	Regenerated lock workflow with gh-aw v0.75.0 action + updated container pins.
.github/workflows/malicious-code-scan.lock.yml	Regenerated lock workflow with gh-aw v0.75.0 action + updated container pins.
.github/workflows/issue-arborist.lock.yml	Regenerated lock workflow with gh-aw v0.75.0 action + updated container pins.
.github/workflows/duplicate-code-detector.lock.yml	Regenerated lock workflow with gh-aw v0.75.0 action + updated container pins.
.github/workflows/dependabot-pr-bundler.lock.yml	Regenerated lock workflow with gh-aw v0.75.0 action + updated container pins.
.github/workflows/dependabot-issue-bundler.lock.yml	Regenerated lock workflow with gh-aw v0.75.0 action + updated container pins.
.github/workflows/daily-file-diet.lock.yml	Regenerated lock workflow with gh-aw v0.75.0 action + updated container pins.
.github/workflows/agentics-maintenance.yml	Bumps gh-aw setup/setup-cli usage and version string to v0.75.0.
.github/workflows/agentic_commands.yml	Bumps gh-aw version markers and setup action tag to v0.75.0.
.github/aw/actions-lock.json	Adds v0.75.0 action SHAs and updated container digests used for strict compilation.

Copilot's findings

• Files reviewed: 31/31 changed files
• Comments generated: 1