fix(smoke): replace unsatisfiable web-fetch check with curl egress check (#830)

* fix(smoke): replace unsatisfiable web-fetch check with curl egress check

The Codex CLI has no web-fetch tool — it only supports web_search. gh-aw's
`-c fetch="disabled"` toggle is a no-op config key, so the compiled lock was
already correct and test 2 could never pass. Swap it for a curl request to
github.com, which is already allow-listed by `network: github` and still
exercises egress through the AWF firewall.

Note: .lock.yml still needs recompiling with gh aw v0.86.1.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: David Slater <12449447+davidslater@users.noreply.github.com>

* fix(smoke): fail the codex egress check on HTTP errors

`curl -sSL` exits 0 for 4xx/5xx responses, so an AWF/Squid denial page would
count as a successful fetch — and since that page can echo the requested URL,
it could even satisfy the substring check. Add `-f` so HTTP errors exit
non-zero, and require an exit code of 0 alongside the text match.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: David Slater <12449447+davidslater@users.noreply.github.com>

---------

Co-authored-by: GitHub Ace <githubnext@users.noreply.github.com>
Co-authored-by: David Slater <12449447+davidslater@users.noreply.github.com>

Author: davidslater

.github/workflows/smoke-codex-standalone.md

@@ -68,7 +68,7 @@ requirement — do not keep waiting.
 ## Test Requirements
 
 1. Use GitHub tools to read the latest 2 pull requests in `${{ github.repository }}` and record their numbers and titles only.
-2. Use `web-fetch` to fetch `https://github.com/github/gh-aw-threat-detection` and verify the response mentions `gh-aw-threat-detection`.
+2. Use bash to run `curl -fsSL https://github.com/github/gh-aw-threat-detection` and verify the command exits `0` **and** its output mentions `gh-aw-threat-detection`. The `-f` flag is required so an HTTP 4xx/5xx response (for example an AWF/Squid denial page, which may itself echo the requested URL) fails instead of counting as a successful fetch. This is an egress check through the AWF firewall: the Codex CLI has no web-fetch tool, so do **not** try to satisfy this with `web-fetch`.
 3. Use bash to run `make lint` and `make build` in `${{ github.workspace }}` and verify both succeed.
 4. Use bash to create a minimal artifacts directory under `/tmp/gh-aw/smoke-codex-standalone-${{ github.run_id }}` with:
    - `aw-prompts/prompt.txt`