feat(catalog): add mlr, gh-aw, and gh-aw-firewall

[CybotTM]

Summary

Adds three new GitHub-release-binary catalog entries (catalog grows 93 → 96):

• mlr (Miller) — awk/sed/cut/jq for CSV, TSV, JSON, and JSON Lines. Standard tar.gz release layout from johnkerl/miller. Arch map matches existing convention (amd64/arm64/armv7). Category: general, alongside jq/yq/qsv.
• gh-aw — GitHub Agentic Workflows. A tool that compiles natural-language Markdown workflow definitions into hardened GitHub Actions workflows. Direct-binary download (no archive), modeled on the existing direnv pattern. Category: platform.
• gh-aw-firewall (binary awf) — Squid-proxy-based egress firewall that sandboxes AI agent commands in a Docker container with a domain allowlist. Direct-binary download; upstream asset names use x64 (not amd64), so arch_map reflects that. Category: platform.

Decisions

• gh-aw install method: Upstream's documented install path is gh extension install github/gh-aw, but the catalog does not currently model gh CLI extensions as an install_method. Since github/gh-aw publishes prebuilt per-arch binaries alongside the extension, I used github_release_binary (matching what the task prompt approved) and documented the alternative install path in the entry's notes field for maintainers and users.
• gh-aw-firewall arch_map: Upstream uses x64/arm64 rather than the more common amd64/arm64, so the entry maps x86_64 -> x64. armv7l is omitted because upstream does not publish an armv7 binary.
• No changes to CATALOG_SUMMARY.md / COVERAGE.md: Both docs are manually maintained snapshots whose totals already lag the catalog (last touched 2026-04-18 at 45 / 56 / 89 entries vs. the actual 93 pre-change). Left alone to keep this PR scoped and avoid drift-fixing unrelated tools.

Test plan

• All three new JSON files parse cleanly (jq . catalog/*.json).
• uv run python -m pytest -x -q --ignore=tests/integration — 598 passed, 1 skipped.
• tests/test_catalog_and_collectors.py (schema-validity sweep across all catalog/*.json) — 28 passed.
• ./scripts/test_smoke.sh — green.
• ToolCatalog().has_tool(...) returns True for all three new names; total entries 96.
• Verified upstream asset URLs resolve (HTTP 302 to GitHub release CDN) for mlr v6.18.1, gh-aw v0.71.5, gh-aw-firewall v0.25.43.
• Actual make install-mlr / make install-gh-aw / make install-gh-aw-firewall smoke install on a clean host (not run here — relies on network + writeable ~/.local/bin).

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[gemini-code-assist]

Code Review

This pull request introduces three new tool definitions to the catalog: gh-aw-firewall, gh-aw, and mlr. Feedback was provided for the mlr definition, noting that the armv7l architecture mapping should be removed because the upstream repository does not provide binaries for that architecture, which would lead to installation errors.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.47%. Comparing base (ed23db2) to head (d024774).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #81      +/-   ##
==========================================
- Coverage   69.56%   69.47%   -0.09%     
==========================================
  Files          22       22              
  Lines        3345     3345              
==========================================
- Hits         2327     2324       -3     
- Misses       1018     1021       +3     

Flag	Coverage Δ
unittests	69.47% <ø> (-0.09%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Adds three new tool catalog entries to enable installation via the existing github_release_binary installer for Miller and two GitHub Agentic Workflows-related binaries.

Changes:

• Added mlr (Miller) GitHub release tarball install metadata with arch mapping.
• Added gh-aw direct-binary GitHub release install metadata (with notes about the gh extension alternative).
• Added gh-aw-firewall (awf) direct-binary GitHub release install metadata with x86_64 -> x64 arch mapping and Docker runtime note.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
catalog/mlr.json	New mlr entry using GitHub release tarball URL template + arch_map.
catalog/gh-aw.json	New gh-aw entry using direct GitHub release binary downloads + notes.
catalog/gh-aw-firewall.json	New gh-aw-firewall entry (awf) using direct GitHub release binary downloads + x64 arch mapping + runtime note.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud