refactor: complete Engine abstraction — move install, invocation, and paths behind Engine enum

[jamesadevine]

Summary

PR #286 introduced the Engine enum and aligned the front matter with gh-aw, but several Copilot-specific artifacts remain hardcoded in templates and common.rs. This issue tracks moving them behind the Engine abstraction so adding a new engine doesn't require touching templates.

Work Items

1. Move install steps into Engine

The pipeline templates (base.yml, 1es-base.yml) hardcode Copilot CLI installation:

• NuGetAuthenticate@1 + NuGetCommand@2 to install Microsoft.Copilot.CLI.linux-x64
• Copying the binary to /tmp/awf-tools/copilot
• copilot --version verification

These should be generated by Engine::install_steps() (or similar) and substituted via a {{ engine_install }} marker. The COPILOT_CLI_VERSION constant moves into the Copilot engine impl.

2. Move engine invocation into Engine

The AWF run command in templates hardcodes:

/tmp/awf-tools/copilot --prompt "..." --additional-mcp-config @... {{ copilot_params }}

This should be generated by Engine::invocation() (or folded into an {{ engine_run }} marker) so the binary path, prompt flag, and MCP config flag are engine-owned.

3. Rename remaining copilot_* identifiers

• generate_copilot_params() → generate_engine_args() (or inline into ctx.engine.args() call)
• {{ copilot_params }} → {{ engine_args }}
• copilot_version → engine_version (or remove — version belongs to the engine impl)
• COPILOT_CLI_VERSION constant → engine-owned
• Variable copilot_params in compile_shared() → engine_args

4. Clean up the Detection job install

The Detection job (base.yml line ~420) duplicates the same Copilot CLI install steps. Once install is engine-generated, both Agent and Detection jobs should use the same {{ engine_install }} marker.

5. Move mcp-config.json path into Engine

The $HOME/.copilot/mcp-config.json path and /tmp/awf-tools/mcp-config.json are Copilot-specific. Other engines may use different config locations.

6. Engine log paths

~/.copilot/logs is hardcoded in log collection steps. Should be engine-owned so log paths are correct for non-Copilot engines.

Non-goals (separate issues)

• Implementing a second engine (Claude, Codex, etc.) — this issue is about making the abstraction complete
• Wiring engine.version / engine.command / engine.agent front matter fields through to the templates (parsed but not yet plumbed)
• Removing SYSTEM_ACCESSTOKEN from Stage 3 executor (tracked separately)