Model routing: routed workflows run stale AWF and router images regardless of the AWF version #66226

Summary

Every workflow with engine.model-routing runs AWF's container images from v0.28.30 and a
30 Sep latest build of the router, whatever AWF version the workflow or gh-aw selects.

• The AWF version setting (sandbox.agent.version, or gh-aw's DefaultFirewallVersion) only
  changes the AWF CLI.
• The api-proxy image, which does the routing, stays at 0.28.30. So routed workflows miss AWF's
  routing work since then:
  • advisory routing (gh-aw-firewall#9272), so sub-agents and other deviating requests are
    rejected instead of admitted;
  • routing Copilot Claude reasoning models (Security: Handle Close() errors on writable files in zip extraction #9332);
  • routing.candidateModels (Document MCP configuration architecture - no refactoring needed #9382);
  • the persisted routing log, model-routing.jsonl (Purge orphaned .campaign.g.md files and their lock files with --purge flag #9451).
• The router is gh-aw-router 0.1.2, so it uses the tables from before the current release.
• The router image also can't be overridden from a workflow.

Evidence

• Compiled lock file. In the test repository githubnext/gh-aw-routing-sandbox (compiled
  from main with --gh-aw-ref):
  • sandbox.agent.version: v0.28.35 produced install_awf_binary.sh v0.28.35 and the v0.28.35
    config schema;
  • but the image manifest and container.images still listed gh-aw-firewall/*:0.28.30 and
    gh-aw-router:latest@sha256:d1612d0e….
• Run evidence. In routed runs on GitHub-hosted runners, the router reported
  "router": {"name": "gh-aw-router", "version": "0.1.2"} in AWF's routing log. Routing,
  advisory admission, and the routing log only behaved as current AWF intends after the workflow
  pinned the v0.28.35 images itself under sandbox.agent.images.
• Override attempt. sandbox.agent.images.router fails to compile with "Unknown property:
  router. Valid fields are: agent, config, mcp, type".

Cause

• getSandboxAgentImages in pkg/workflow/sandbox_agent_images.go fills every image role that
  the workflow doesn't set from modelRoutingDefaultImages. That's a hardcoded map, added in
  Support AWF task-level model routing in the Copilot engine #64593 on 30 Sep and unchanged since:
  • squid, agent, api-proxy, and cli-proxy at 0.28.30 with digests;
  • router at ghcr.io/githubnext/gh-aw-router:latest@sha256:d1612d0e…, which matches no
    release tag.
• Non-routed workflows don't have this problem: buildAWFImageTagWithDigests in
  pkg/workflow/awf_arc_dind.go builds image references from the effective AWF version and looks
  up digests in the pinned image data. The routing path doesn't use that.
• pkg/workflow/data/action_pins.json has AWF image pins up to 0.28.31, and gh-aw's
  DefaultFirewallVersion is v0.28.31. The latest AWF release is v0.28.37.
• The sandbox.agent.images schema in pkg/parser/schemas/main_workflow_schema.json lists
  squid, agent, api-proxy, cli-proxy, build-tools, doh-proxy, and dind-staging, but not router.
  This is despite sandbox_agent_images.go defining and validating a router role
  (awfImageRoleRouter, gated on AWFRouterImageRoleMinVersion).

Proposed plan

1. Derive the routing AWF images from the effective AWF version.
   • Build squid, agent, api-proxy, and cli-proxy references for routed workflows the same way
     non-routed workflows do: from the effective AWF version (sandbox.agent.version, or
     DefaultFirewallVersion), with digests from the pinned image data.
   • Remove the hardcoded AWF entries from modelRoutingDefaultImages.
   • Fail compilation with a clear message if the effective version has no digest pins, rather
     than silently using another version.
2. Pin the router to a release.
   • Add a router version constant next to the AWF version constants, starting at 0.1.3.
   • Add its digest to the pinned image data and use that reference instead of latest.
   • Bump it with router releases, like the AWF and MCP gateway pins.
3. Allow overriding the router image. Add router to the sandbox.agent.images schema,
   using the existing pinned-image definition. The compiler already validates the role.
4. Bump the AWF pin.
   • Move DefaultFirewallVersion to the latest AWF release (v0.28.37 at the time of writing; at
     least v0.28.35 for model-routing.jsonl).
   • Add its image digests to the pinned image data.
   • Note: v0.28.32 has a git tag and images but no GitHub release, so install_awf_binary.sh
     gets a 404 for it. The pin must name a published release.
5. Tests.
   • Compile a routed workflow with the default AWF version and with sandbox.agent.version set.
     Assert that the AWF image references in the manifest and container.images match the
     effective version.
   • Assert that the router reference is the pinned release, that sandbox.agent.images.router
     overrides it, and that an unpinned AWF version fails clearly.