Update Runner Doctor catalog for B13 Squid ACL gap and B9 RHEL/Amazon Linux CA mount fix

[Copilot]

Runner Doctor’s 2026-07-20/21 scan surfaced two new catalog deltas: B13 needed the final Squid ACL closure beyond NO_PROXY-only fixes, and B9 needed the newer RHEL/Amazon Linux CA mount-policy citation/update. This PR updates the shared failure-mode catalog and the portable embedded catalog so triage guidance stays aligned.

• B13: complete the topology/DIFC proxy fix chain

  • Extended Fix / flag to include github/gh-aw-firewall#6473:
    • topology peer hostnames + difcProxyHost now auto-added to Squid ACL allowlist via resolveAllowedDomains()
    • behavior gated to networkIsolation=true + compose runtime (runtimeUsesComposeAgent()), excluding sbx
  • Extended Probe to distinguish “has Exclude topology-attached MCP peers from agent proxy routing #6189/fix: exempt DIFC/cli-proxy host from proxy routing in isolation mode #6438 but missing Auto-allow topology-attached container hostnames in Squid ACL #6473” by checking post-upgrade TCP_DENIED and generated allowedDomains.
  • Added #6473 to B13 citations.

• B9: include mount-policy hardening for RHEL-family CA paths

  • Extended Fix / flag to include github/gh-aw-firewall#6460:
    • /etc/pki/ca-trust and /etc/pki/tls are now in chroot mount policy, making /host/etc/pki CA paths directly readable.
  • Preserved older-version workaround language for staged bundle/env-var override.
  • Added #6460 to B9 citations.

• Catalog parity guardrails

  • Applied the same B9/B13 edits to:
    • .github/workflows/shared/self-hosted-failure-modes.md
    • .github/agents/self-hosted-runner-doctor.md
  • Updated scripts/ci/self-hosted-runner-doctor-workflow.test.ts assertions to lock the new B9/B13 text/citations across shared + portable copies.

| B13 | ... | ... | **Fixed in AWF (...#6189)... (...#6438)... **Fixed in AWF (...#6473...)** ... |
| B9  | ... | ... | **Fixed in AWF (...#5783)... **Further fixed in AWF (...#6460...)** ...       |

• Fixes 🩺 Runner Doctor UpdateRunner Doctor catalog update — B13 Squid ACL gap, B9 RHEL CA mount fix (2026-07-20–21 scan) #6483