[WIP] Fix firewall implementation on claude and update dependencies (#4884)

* Initial plan

* fix: remove github-script@v7 from action pins to fix failing test

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Author: Copilot

.github/aw/actions-lock.json

@@ -25,11 +25,6 @@
       "version": "v6",
       "sha": "018cc2cf5baa6db3ef3c5f8a56943fffe632ef53"
     },
-    "actions/github-script@v7": {
-      "repo": "actions/github-script",
-      "version": "v7",
-      "sha": "f28e40c7f34bde8b3046d885e986cb6290c5673b"
-    },
     "actions/github-script@v8": {
       "repo": "actions/github-script",
       "version": "v8",

docs/src/content/docs/labs.mdx

@@ -70,7 +70,6 @@ These are experimental agentic workflows used by the GitHub Next team to learn,
 | [Python Data Visualization Generator](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/python-data-charts.md) | copilot | [![Python Data Visualization Generator](https://github.com/githubnext/gh-aw/actions/workflows/python-data-charts.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/python-data-charts.lock.yml) | - | - |
 | [Q](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/q.md) | copilot | [![Q](https://github.com/githubnext/gh-aw/actions/workflows/q.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/q.lock.yml) | - | `/q` |
 | [Release](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/release.md) | copilot | [![Release](https://github.com/githubnext/gh-aw/actions/workflows/release.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/release.lock.yml) | - | - |
-| [Release Highlights Generator](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/release-highlights.md) | copilot | [![Release Highlights Generator](https://github.com/githubnext/gh-aw/actions/workflows/release-highlights.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/release-highlights.lock.yml) | - | - |
 | [Repository Quality Improvement Agent](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/repository-quality-improver.md) | copilot | [![Repository Quality Improvement Agent](https://github.com/githubnext/gh-aw/actions/workflows/repository-quality-improver.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/repository-quality-improver.lock.yml) | `0 13 * * 1-5` | - |
 | [Repository Tree Map Generator](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/repo-tree-map.md) | copilot | [![Repository Tree Map Generator](https://github.com/githubnext/gh-aw/actions/workflows/repo-tree-map.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/repo-tree-map.lock.yml) | `0 15 * * 1` | - |
 | [Resource Summarizer Agent](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/pdf-summary.md) | copilot | [![Resource Summarizer Agent](https://github.com/githubnext/gh-aw/actions/workflows/pdf-summary.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/pdf-summary.lock.yml) | - | `/summarize` |
@@ -82,6 +81,7 @@ These are experimental agentic workflows used by the GitHub Next team to learn,
 | [Smoke Claude](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/smoke-claude.md) | claude | [![Smoke Claude](https://github.com/githubnext/gh-aw/actions/workflows/smoke-claude.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/smoke-claude.lock.yml) | `0 0,6,12,18 * * *` | - |
 | [Smoke Codex](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/smoke-codex.md) | codex | [![Smoke Codex](https://github.com/githubnext/gh-aw/actions/workflows/smoke-codex.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/smoke-codex.lock.yml) | `0 0,6,12,18 * * *` | - |
 | [Smoke Copilot](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/smoke-copilot.md) | copilot | [![Smoke Copilot](https://github.com/githubnext/gh-aw/actions/workflows/smoke-copilot.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/smoke-copilot.lock.yml) | `0 0,6,12,18 * * *` | - |
+| [Smoke Copilot No Firewall](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/smoke-copilot-no-firewall.md) | copilot | [![Smoke Copilot No Firewall](https://github.com/githubnext/gh-aw/actions/workflows/smoke-copilot-no-firewall.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/smoke-copilot-no-firewall.lock.yml) | `0 0,6,12,18 * * *` | - |
 | [Smoke Detector - Smoke Test Failure Investigator](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/smoke-detector.md) | claude | [![Smoke Detector - Smoke Test Failure Investigator](https://github.com/githubnext/gh-aw/actions/workflows/smoke-detector.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/smoke-detector.lock.yml) | - | - |
 | [Static Analysis Report](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/static-analysis-report.md) | claude | [![Static Analysis Report](https://github.com/githubnext/gh-aw/actions/workflows/static-analysis-report.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/static-analysis-report.lock.yml) | `0 9 * * *` | - |
 | [Super Linter Report](https://github.com/githubnext/gh-aw/blob/main/.github/workflows/super-linter.md) | copilot | [![Super Linter Report](https://github.com/githubnext/gh-aw/actions/workflows/super-linter.lock.yml/badge.svg)](https://github.com/githubnext/gh-aw/actions/workflows/super-linter.lock.yml) | `0 14 * * 1-5` | - |

docs/src/content/docs/reference/frontmatter-full.md

@@ -2176,9 +2176,11 @@ safe-outputs:
   jobs:
     {}
 
-  # Custom message templates for safe-output footer and notification messages. Use
-  # format strings with placeholders like {workflow_name}, {run_url},
-  # {triggering_number}.
+  # Custom message templates for safe-output footer and notification messages.
+  # Available placeholders: {workflow_name} (workflow name), {run_url} (GitHub
+  # Actions run URL), {triggering_number} (issue/PR/discussion number),
+  # {workflow_source} (owner/repo/path@ref), {workflow_source_url} (GitHub URL to
+  # source), {operation} (safe-output operation name for staged mode).
   # (optional)
   messages:
     # Custom footer message template for AI-generated content. Available placeholders:
@@ -2204,6 +2206,24 @@ safe-outputs:
     # (optional)
     staged-description: "example-value"
 
+    # Custom message template for workflow activation comment. Available placeholders:
+    # {workflow_name}, {run_url}, {event_type}. Default: 'Agentic
+    # [{workflow_name}]({run_url}) triggered by this {event_type}.'
+    # (optional)
+    run-started: "example-value"
+
+    # Custom message template for successful workflow completion. Available
+    # placeholders: {workflow_name}, {run_url}. Default: '✅ Agentic
+    # [{workflow_name}]({run_url}) completed successfully.'
+    # (optional)
+    run-success: "example-value"
+
+    # Custom message template for failed workflow. Available placeholders:
+    # {workflow_name}, {run_url}, {status}. Default: '❌ Agentic
+    # [{workflow_name}]({run_url}) {status} and wasn't able to produce a result.'
+    # (optional)
+    run-failure: "example-value"
+
   # Runner specification for all safe-outputs jobs (activation, create-issue,
   # add-comment, etc.). Single runner label (e.g., 'ubuntu-slim', 'ubuntu-latest',
   # 'windows-latest', 'self-hosted'). Defaults to 'ubuntu-slim'. See