Compile enclaves through one multi-agent MCP gateway

[lpcox]

Summary

Replace the dedicated enclave GitHub proxy process with the workflow's existing MCP Gateway, using mcpg's concurrent multi-agent isolation.

The compiler currently starts Start Enclave GitHub Proxy and Start MCP Gateway as separate mcpg processes. It also emits only singular gateway.agentId, even though the gateway schema supports agentIds and mcpg main now supports per-agent runtime isolation and policies.

Dependencies

• Isolate runtime access for multiple gateway agent IDs gh-aw-mcpg#12186 merged concurrent multi-agent runtime isolation.
• Use the first gh-aw-mcpg release containing merge commit ccc66fdbed097ec878f4062594034fb79f25d8b2.
• Specify mutually exclusive gateway agentId and agentIds fields #56939 added the agentId/agentIds specification.
• Migrate MCP gateway compiler output to agentId #56990 migrated generated configuration from apiKey to singular agentId.

Most compiler work can proceed before the new mcpg release; keep the version and immutable digest update as the final integration change.

Required work

• Extend compiler runtime/config types to represent multiple gateway agent IDs and per-agent policies.
• Generate independent cryptographically random identifiers for the primary agent and enclave access paths.
• Render gateway.agentIds and gateway.agentPolicies in mcpg stdin JSON.
• Give the primary identity only the workflow's ordinary MCP server/tool surface.
• Give enclave identities only their declared server/tool/profile and allow-only repository policy.
• Preserve protected handoff of enclave credentials; neither the primary agent nor unrelated enclave invocations may receive them.
• Configure enclave GitHub proxy support on the existing gateway process.
• Remove the separate Start Enclave GitHub Proxy and Stop Enclave GitHub Proxy lifecycle.
• Preserve capability verification, repository assignment, DIFC labeling, audit attribution, and identifier redaction.
• Update schemas, generated fixtures, compiler tests, documentation, and workflow lock outputs.
• Bump the default mcpg release and immutable digest once the release containing [plan] Add gosec scan duration monitoring to CI workflows #12186 is available.

Acceptance criteria

• Compiled enclave workflows start exactly one mcpg process.
• Generated gateway JSON validates and contains agentIds plus complete fail-closed agentPolicies.
• Primary and enclave requests can execute concurrently with independent session/DIFC state.
• The primary identity cannot invoke enclave-only servers, tools, routes, repositories, or operations.
• One enclave identity cannot access or close another identity's session.
• Agent IDs and capability material are absent from plaintext logs, generated diagnostics, and the primary agent environment.
• Existing non-enclave and singular-agent workflows retain their current behavior.
• Compiler unit/golden tests cover singular compatibility, shared-gateway enclaves, malformed policies, identifier leakage, and removal of the dedicated proxy steps.

Follow-up validation

Recompile the gh-aw-firewall Issues-read enclave smoke workflow and validate the shared-gateway topology before migrating production cross-repository workflows.