fix: replace broken gh-aw install step in token audit workflow

[lpcox]

Problem

The compiler generates an Install gh-aw extension step that uses gh extension list | grep to detect whether gh-aw is installed. When gh-aw was already installed via curl | bash (from copilot-setup-steps.yml), gh extension list doesn't detect it, so the step tries gh extension install github/gh-aw which fails (directory already exists), and set -e kills the script before the binary copy for MCP containerization runs.

Failed run: https://github.com/github/gh-aw/actions/runs/23987203365

Fix

• Create shared/mcp/gh-aw.md shared component with correct install logic:
  • Uses gh aw --version to detect existing installs (works regardless of install method)
  • Falls back to curl | bash install (same as copilot-setup-steps.yml)
  • Copies binary to ${RUNNER_TEMP}/gh-aw/gh-aw for MCP containerization
• Import it in copilot-token-audit.md so the compiler skips its broken step
• Remove redundant Install gh-aw CLI step (now handled by the shared component)

Scope

Only the token audit workflow is updated in this PR. Other affected workflows can adopt shared/mcp/gh-aw.md separately.

[Copilot]

Pull request overview

This PR fixes failures in the Copilot token audit workflow caused by a brittle gh-aw install step by introducing a shared install component that detects existing installs via gh aw --version and ensures the gh-aw binary is copied into ${RUNNER_TEMP} for MCP containerization.

Changes:

• Added a reusable workflow component to install/detect gh-aw and copy its binary to ${RUNNER_TEMP}/gh-aw/gh-aw.
• Updated the token audit workflow to import the shared component and removed the redundant legacy install step.
• Regenerated the compiled lock workflow to reflect the new import and step ordering.

Show a summary per file

File	Description
.github/workflows/shared/mcp/gh-aw.md	New shared component providing robust gh-aw detection/install and binary copy for MCP containerization.
.github/workflows/copilot-token-audit.md	Imports the shared gh-aw installer component and removes the redundant install step.
.github/workflows/copilot-token-audit.lock.yml	Compiled workflow updated to include the new shared import and replace the previous broken install logic.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 1

[Copilot]

The install command pulls install-gh-aw.sh from refs/heads/main, which makes the workflow non-deterministic (a change to the script on main can change behavior for older workflow revisions) and can also prevent PR changes to install-gh-aw.sh from being exercised in CI. Consider preferring the checked-out install-gh-aw.sh when present (or pinning the raw URL to a specific tag/commit) so the install logic matches the workflow revision being run.

Suggested change

	curl -fsSL https://raw.githubusercontent.com/github/gh-aw/refs/heads/main/install-gh-aw.sh | bash
	if [ -f ./install-gh-aw.sh ]; then
	bash ./install-gh-aw.sh
	else
	curl -fsSL https://raw.githubusercontent.com/github/gh-aw/refs/heads/main/install-gh-aw.sh | bash
	fi