ci: align agent toolchain versions

[rickylabs]

Summary

Fixes the CI/agent toolchain drift that let OpenHands and Copilot bootstrap with stale or mismatched runner tools.

Changes

• Adds .github/toolchain.env as the shared NetScript CI/agent toolchain source:
  • Deno v2.7.11
  • .NET SDK 10.0.x / install channel 10.0
  • Aspire CLI 13.2.2
• Updates Copilot setup to read that file, install Deno/.NET/Aspire from it, verify Aspire exactly matches the scaffold SDK constant, and provision latest stable Docker via docker/setup-docker-action@v5.
• Updates OpenHands workflow hydration so PR-triggered runs get the toolchain file from the workflow/default-branch ref, even when the target PR branch is older.
• Updates OpenHands bootstrap to fail closed instead of accepting stale tools:
  • upgrades/downgrades Deno to the configured exact 2.7.x patch
  • installs .NET 10 when only older SDKs are present
  • always installs Aspire CLI 13.2.2 over any stale preinstalled 8.x
  • fails if Docker or Docker Compose are unavailable

Why

The failing database.init E2E gate is caused by CI using an incompatible Aspire CLI/runtime environment. The project scaffold constants target Aspire 13.2.2, so CI and cloud-agent bootstrap must install that version instead of using whichever aspire binary happens to be on the runner.

Validation

• bash -n .openhands/setup.sh
• Parsed both workflow YAML files with jsr:@std/yaml
• git diff --check

The Deno YAML parse emitted existing workspace config warnings from examples/playground/deno.json; both workflow files parsed successfully.

[augmentcode]

🤖 Augment PR Summary

Summary: Aligns CI/agent bootstrap tooling so Copilot/OpenHands runs use the same pinned Deno/.NET/Aspire versions.

Changes:

• Introduces .github/toolchain.env as the single source of truth for toolchain pins.
• Updates the Copilot setup workflow to read those pins, install Deno/.NET/Aspire, and verify the Aspire version matches scaffold constants.
• Adds Docker provisioning via docker/setup-docker-action@v5 in Copilot and OpenHands workflows.
• Updates OpenHands hydration so PR runs pull the toolchain file from the workflow ref.
• Makes OpenHands bootstrap fail closed by enforcing tool versions and requiring Docker/Compose.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

.github/workflows/copilot-setup-steps.yml:69: Switching to installer_url="https://aspire.dev/install.sh" without any pin/hash verification means CI is now trusting a mutable remote script, which weakens supply-chain integrity compared to the previous pinned+verified installer.

Severity: high

Other Locations

• .openhands/setup.sh:50

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[augmentcode]

.github/workflows/copilot-setup-steps.yml:83: test "$actual" = "..." assumes aspire --version outputs exactly the raw version string; if the CLI ever includes a prefix/suffix this will fail even when the correct version is installed.

Severity: medium

Other Locations

• .openhands/setup.sh:65

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}