Embed the bootstrap registration template safely

[Copilot]

The security report flagged command-injection paths in issue-closing handlers and possible template injection in the GitHub App registration page.

• Registration page: Move the HTML into a statically embedded file. Parse only that embedded template, and pass the registration URL and manifest as execution data.

  //go:embed bootstrap_registration_page.html
  var bootstrapRegistrationPageFS embed.FS

• Regression coverage: Verify script-like URL and manifest values remain escaped.
• Issue-closing handlers: The reported exec/asShellArg paths are absent from this checkout; the current handler uses GitHub API calls without shell execution.

• Fixes [sighthound] Security findings in github/gh-aw #64924

[Copilot]

Copilot review overview

🟢 Approval recommended

The embedded template preserves contextual escaping, regression coverage matches runtime output, and refreshed dependency pins are valid.

Review effort: Balanced
Findings: None

What changed in this PR

Moves the GitHub App registration HTML into a statically embedded template, preventing request-derived values from becoming template source.

Changes:

• Parses the embedded HTML with html/template.
• Adds regression coverage for untrusted URL and manifest values.
• Refreshes generated workflow and action lock data.

File	Description
pkg/​cli/​bootstrap_registration_page.html	Adds the static registration template.
pkg/​cli/​bootstrap_profile_helpers.go	Embeds and parses the template safely.
pkg/​cli/​bootstrap_profile_helpers_test.go	Tests contextual escaping.
.github/​workflows/​visual-regression-checker.lock.yml	Refreshes generated firewall configuration.
.github/​workflows/​spec-enforcer.lock.yml	Updates the coverage action pin.
.github/​workflows/​purelock.lock.yml	Updates the coverage action pin.
.github/​aw/​actions-lock.json	Synchronizes action pins with workflow sources.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.90.3