fix: debug logging for GITHUB_PATH merge + document setup-* tool availability in chroot

[Copilot]

readGitHubPathEntries() silently returned [] when GITHUB_PATH was unset or unreadable, making it impossible to diagnose why tools installed by setup-* actions (e.g. astral-sh/setup-uv) resolved as command not found inside the AWF chroot.

Changes

• src/docker-manager.ts — readGitHubPathEntries(): emit debug-level log messages for the two previously silent failure paths:

  • GITHUB_PATH env var not set (includes a note that sudo PATH reset may be the cause)
  • GITHUB_PATH file path set but unreadable (logs the attempted path)

  With --log-level debug you now see one of:

  [DEBUG] Merged 3 path(s) from $GITHUB_PATH into AWF_HOST_PATH
  [DEBUG] GITHUB_PATH env var is not set; skipping $GITHUB_PATH file merge …
  [DEBUG] GITHUB_PATH file at '/home/runner/_work/_temp/_runner_file_commands/add_path_…' could not be read; skipping file merge
  

• docs/environment.md — New "GitHub Actions setup-* Tool Availability" section documenting:

  • The GITHUB_PATH → AWF_HOST_PATH → chroot PATH pipeline (introduced in v0.60.0)
  • Fallback behaviour when GITHUB_PATH is absent (relies on process.env.PATH which sudo may have reset)
  • --log-level debug troubleshooting guidance with expected log output

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[github-actions]

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit b89d711

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	82.72%	82.83%	📈 +0.11%
Statements	82.38%	82.49%	📈 +0.11%
Functions	81.50%	81.50%	➡️ +0.00%
Branches	76.19%	76.25%	📈 +0.06%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/docker-manager.ts	86.0% → 86.5% (+0.46%)	85.5% → 85.9% (+0.45%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

🔮 Oracle Smoke Ledger
PR titles reviewed: "rename awf-issue-auditor → firewall-issue-dispatcher and prefix created issues with [awf]"; "feat: add --env-file support for injecting env vars from a file"
GitHub MCP review (last 2 merged PRs): ✅
safeinputs-gh PR query (2 PRs): ❌ (tool unavailable in runtime)
Playwright github.com title contains "GitHub": ✅
Tavily search "GitHub Agentic Workflows Firewall": ❌ (tool unavailable in runtime)
File write + bash cat verification: ✅
Discussion query + mystical discussion comment: ❌ (required discussion query/comment tool path unavailable)
Build (npm ci && npm run build): ✅
Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex

Warning

⚠️ Firewall blocked 5 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• api.github.com
• chatgpt.com
• github.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "api.github.com"
    - "chatgpt.com"
    - "github.com"
    - "registry.npmjs.org"

See Network Configuration for more information.