fix: use npx to run Claude CLI when AWF firewall is enabled

[Copilot]

When AWF firewall is enabled for Claude engine, the claude CLI isn't accessible inside the container because npm global binaries aren't mounted.

Changes

• Use npx -y @anthropic-ai/claude-code@version when firewall is enabled, matching Copilot's pattern
• Keep direct claude invocation for non-firewall mode (global npm install)

if isFirewallEnabled(workflowData) {
    // npx handles package resolution inside container
    commandParts := []string{fmt.Sprintf("npx -y @anthropic-ai/claude-code@%s", claudeVersion)}
} else {
    // Use globally installed claude
    commandParts := []string{"claude"}
}

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)