Bump gh-aw-firewall to v0.28.2

[lpcox]

Summary

This PR bumps the default gh-aw-firewall version from v0.28.1 to v0.28.2 and refreshes the embedded container digest pins for the four firewall components (agent, api-proxy, cli-proxy, squid). A changeset entry documents the patch-level update.

Change Classification

• Type: dependency-update
• Scope: pkg/constants, pkg/actionpins, pkg/workflow
• Breaking: No

Key Changes

File	Change	Impact
pkg/constants/version_constants.go	Updated DefaultFirewallVersion constant from v0.28.1 to v0.28.2	high
pkg/actionpins/data/action_pins.json	Added digest pins for gh-aw-firewall v0.28.2 (agent, api-proxy, cli-proxy, squid)	medium
pkg/workflow/data/action_pins.json	Added digest pins for gh-aw-firewall v0.28.2 (agent, api-proxy, cli-proxy, squid)	medium
.changeset/patch-bump-awf-v0-28-2.md	Added changeset entry for the patch bump	low

Impact Assessment

• All workflows compiled after this change will default to gh-aw-firewall v0.28.2 unless a workflow explicitly pins an older version.
• New container image digest pins must resolve correctly at compile/run time; no CLI or API surface changes are introduced.

Commits

0c3f46dc9 Bump gh-aw-firewall to v0.28.2
```> Generated by [PR Description Updater](https://github.com/github/gh-aw/actions/runs/32410928977) for #54321 · auto · 35 AIC · ⌖ 8.11 AIC · ⊞ 7.6K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fpr-description-caveman%22&type=pullrequests)

<!-- gh-aw-agentic-workflow: PR Description Updater, engine: copilot, model: auto, id: 32410928977, workflow_id: pr-description-caveman, run: https://github.com/github/gh-aw/actions/runs/32410928977 -->

[Copilot]

Pull request overview

Updates gh-aw’s default firewall runtime from v0.28.1 to the current v0.28.2 release.

Changes:

• Bumps the default AWF version and adds verified pins for all firewall images.
• Regenerates workflow lock files with v0.28.2.
• Adds a patch changeset; no schema mapping or version-gate changes are required.

Show a summary per file

File	Description
pkg/constants/version_constants.go	Updates the default firewall version.
pkg/actionpins/data/action_pins.json	Adds v0.28.2 image pins.
pkg/workflow/data/action_pins.json	Mirrors the new image pins.
.github/aw/actions-lock.json	Records resolved v0.28.2 digests.
.github/workflows/smoke-ci.lock.yml	Regenerates Smoke CI with v0.28.2.
.github/workflows/notion-issue-summary.lock.yml	Regenerates Cloud Hypervisor workflow.
.github/workflows/hippo-embed.lock.yml	Regenerates CLI-proxy workflow.
.github/workflows/firewall.lock.yml	Regenerates firewall test workflow.
.github/workflows/example-permissions-warning.lock.yml	Regenerates example workflow.
.github/workflows/daily-arxiv-researcher.lock.yml	Regenerates researcher workflow.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Regenerates Codex test workflow.
.changeset/patch-bump-awf-v0-28-2.md	Adds the patch release note.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 21/291 changed files
• Comments generated: 0
• Review effort level: Balanced

[lpcox]

@copilot run pr-finisher skill

[gh-aw-bot]

@copilot Please run the pr-finisher skill on this PR and leave a concise maintainer handoff.

Current blocker on this head:

• Build Windows CLI failed: https://github.com/github/gh-aw/actions/runs/32404616749/job/96541164142

Suggested finish pass:

• inspect the failed Windows build and fix the branch if the failure is code-related
• summarize local validation you ran
• call out any remaining maintainer-only actions

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 32.5 AIC · ⌖ 8.17 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.2