refactor: complete Engine abstraction — move install, invocation, and paths behind Engine trait

[Copilot]

Several Copilot-specific artifacts (NuGet install steps, binary path, $HOME/.copilot, ~/.copilot/logs, /tmp/awf-tools/mcp-config.json) were hardcoded across both pipeline templates and common.rs. This makes adding a new engine require touching templates directly.

Engine trait additions (src/engine.rs)

• install_steps() — YAML steps to install the engine binary
• invocation(prompt_path, mcp_config_path, engine_args) — AWF command string
• version() — engine binary version
• home_config_dir(), log_dir(), mcp_config_path() — engine-specific paths
• COPILOT_CLI_VERSION moved here from compile/common.rs

Template markers (base.yml, 1es-base.yml)

• {{ engine_install }} — replaces hardcoded NuGet + Copilot CLI install (Agent + Detection jobs, both templates)
• {{ engine_run }} / {{ engine_run_detection }} — replaces hardcoded /tmp/awf-tools/copilot --prompt ... invocations
• {{ engine_home_config_dir }} — replaces $HOME/.copilot
• {{ engine_log_dir }} — replaces ~/.copilot/logs
• {{ engine_mcp_config_path }} — replaces /tmp/awf-tools/mcp-config.json

Renamed identifiers

Old	New	Notes
generate_copilot_params()	generate_engine_args()	alias kept
generate_copilot_ado_env()	generate_engine_ado_env()	alias kept
{{ copilot_params }}	{{ engine_args }}	legacy marker kept
{{ copilot_version }}	{{ engine_version }}	legacy marker kept
{{ copilot_ado_env }}	{{ engine_ado_env }}	legacy marker kept

Adding a new engine now requires implementing the Engine trait — no template changes needed:

pub trait Engine {
    fn generate_cli_params(&self, fm: &FrontMatter, ext: &[Extension]) -> Result<String>;
    fn generate_agent_ado_env(&self, read_sc: Option<&str>) -> String;
    fn version(&self) -> &str;
    fn install_steps(&self) -> String;
    fn invocation(&self, prompt: &str, mcp_config: Option<&str>, args: &str) -> String;
    fn home_config_dir(&self) -> &str;
    fn log_dir(&self) -> &str;
    fn mcp_config_path(&self) -> &str;
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dev.azure.com
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-d5652daa30dfc52e /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-d5652daa30dfc52e 629695600986dfb-cgu.1.rcgu.o 629695600986dfb-cgu.2.rcgu.o 629695600986dfb-cgu.3.rcgu.o 629695600986dfb-cgu.4.rcgu.o 20.schemars_derive.eddb870406910005-cgu.13.rcgu.o 8tlmpg451pd8u3zgt429y2.1emnwgg.rcgu.o mdgr9yaykb5spye22ig0pu.1emnwgg.rcgu.o nw14mu80bm3vzj0pdy1pc4.1emnwgg.rcgu.o qdfcgao1e84d0nfajb4me6.1emnwgg.rcgu.o 526y1a1cqcwbharsmuokdq.1emnwgg.rcgu.o 6nz4nw8w7t6pepoc7oi5a1.1emnwgg.rcgu.o x9q8zc1ogmo6qulijd3fty.1emnwgg.rcgu.o e28uxz4epjqhg959oscvwc.1emnwgg.rcgu.o t1ckqs5hmfjp7w5t0750wm.1emnwgg.rcgu.o celjdc7tie78hy59upe1bd.1emnwgg.rcgu.o gzh2ecko4htfvj02qd7mit.1emnwgg.rcgu.o hme4d5oiu98z0adljzbcxa.1emnwgg.rcgu.o fib0mlapxt11hb1im74dby.1emnwgg.rcgu.o 8qi2w49a7s1az0j1pdpwrc.1emnwgg.rcgu.o (dns block)
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-d5652daa30dfc52e /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-d5652daa30dfc52e --emit=dep-info,link -C embed-bitcode=no -C debuginfo=2 s73hj6uw9qoflfyew0r.02kix4b.rcgu.o 6jes4gw7h3gzqbgdkg7.02kix4b.rcgu.o 8sfzh4ujgg74v61mz8h.02kix4b.rcgu.o 9ainxqcxmqdcdiipj9a.02kix4b.rcgu.o xw1rzkmg0sdpjbg7v0n.02kix4b.rcgu.o ucmora8yxpzuarwgkds.02kix4b.rcgu.o 2dtufw8wpcfhycj90aq.02kix4b.rcgu.o wuzygqicdn6giuopyvy.02kix4b.rcgu.o 3hskrkqls9xf83m9n0k.02kix4b.rcgu.o vtbuddhrd8m6va02p46.02kix4b.rcgu.o 8pkvumk58pe9c8hwtee.02kix4b.rcgu.o g80mj11wx3bfh1eooqu.02kix4b.rcgu.o e0ytjjtazvzu5cs45xc.02kix4b.rcgu.o kevrheq42ink68rvzk8.02kix4b.rcgu.o (dns block)
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-d5652daa30dfc52e /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-d5652daa30dfc52e /home/REDACTED/worremote /home/REDACTED/worget-url r remo�� get-url 6jes4gw7h3gzqbgdkg7.18w7a6b.rcgu.o arj8ka2qsly2cqjwhvg.18w7a6b.rcgu.o 90pf4snbcbvvsueb7kt.18w7a6b.rcgu.o 8sfzh4ujgg74v61mz8h.18w7a6b.rcgu.o nmtg3ywpuvtczjwenx5.18w7a6b.rcgu.o vfrkqzwt975boh4pj0j.18w7a6b.rcgu.o 9ainxqcxmqdcdiipj9a.18w7a6b.rcgu.o xw1rzkmg0sdpjbg7v0n.18w7a6b.rcgu.o ucmora8yxpzuarwgkds.18w7a6b.rcgu.o nnhxvdomvhhzp9o7urp.18w7a6b.rcgu.o 2dtufw8wpcfhycj90aq.18w7a6b.rcgu.o l0spsydjqblw4p9ksga.18w7a6b.rcgu.o wuzygqicdn6giuopyvy.18w7a6b.rcgu.o loptvlchxj7iq4gspy5.18w7a6b.rcgu.o (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)