[Copilot]

Update the default firewall from v0.29.6 to v0.29.7 and MCP gateway from v0.5.2 to v0.5.4, keeping authenticated runtime artifacts aligned.

• Runtime pins: Add the reviewed firewall checksum-manifest digest and nine immutable image pins, including router and enclave images.
• Generated workflows: Regenerate 356 lock files; changes are limited to runtime versions, digests, and corresponding metadata.
• Regression coverage: Check all default runtime image pins and extend installer authentication coverage for v0.29.7.
• Documentation: Update default-version references and the pending patch changeset.

Compatibility tests and workflow-drift validation passed. Upstream schema review found no structural changes. CodeQL remains incomplete due to repeated git-diff timeouts.

• Fixes Bump firewall to v0.29.7 and MCP gateway to v0.5.4 #75108

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[Copilot]

🔵 Needs a closer look

The new default pin causes an existing package test to fail because it still expects the old v0.5.2 digest instead of the v0.5.4 digest.

No open issues 🎉

What changed in this PR

This pull request bumps the default firewall to v0.29.7 and MCP gateway to v0.5.4, updating immutable runtime pins, authenticated release metadata, tests, documentation, and generated workflow locks.

Changes:

• Updates default firewall and MCP gateway versions and their image digests.
• Regenerates the affected workflow lock files and embedded action-pin catalogs.
• Extends installer and runtime image regression coverage.
• Updates enclave documentation and the pending changeset.
• A critical issue remains: an existing MCP gateway pin test still expects the old v0.5.2 digest and must be updated.

This pull request requires changes.

File	Description
pkg/​workflow/​firewall_image_tag_test.go	Adds immutable-pin coverage for default runtime images.
pkg/​workflow/​data/​action_pins.json	Updates workflow image pins for the new runtime versions.
pkg/​workflow/​awf_installer_integration_test.go	Extends installer coverage to firewall v0.29.7.
pkg/​constants/​version_constants.go	Updates the default firewall and MCP gateway versions.
pkg/​constants/​version_constants_test.go	Updates expected default-version assertions.
pkg/​actionpins/​data/​action_pins.json	Adds the new firewall and MCP gateway image pin records.
docs/​src/​content/​docs/​experimental/​enclaves.md	Updates the documented default firewall version.
actions/​setup/​sh/​release_integrity.sh	Adds the reviewed firewall v0.29.7 checksum-manifest digest.
actions/​setup/​sh/​install_awf_binary_test.sh	Extends installer authentication coverage to v0.29.7.
.github/​workflows/​smoke-work-queue-dispatcher.lock.yml	Regenerates the compiled workflow runtime pins and metadata.
.github/​workflows/​smoke-pi-auto.lock.yml	Regenerates the compiled workflow runtime pins and metadata.
.github/​workflows/​smoke-github-codex.lock.yml	Regenerates the compiled workflow runtime pins and metadata.
.github/​workflows/​smoke-codex-auto.lock.yml	Regenerates the compiled workflow runtime pins and metadata.
.github/​workflows/​smoke-claude-copilot.lock.yml	Regenerates the compiled workflow runtime pins and metadata.
.github/​workflows/​smoke-ci.lock.yml	Regenerates the compiled workflow runtime pins and metadata.
.github/​workflows/​dev.lock.yml	Regenerates the compiled workflow runtime pins and metadata.
.github/​aw/​enclaves.md	Updates the enclave authoring documentation reference.
.github/​aw/​actions-lock.json	Updates the repository action and container pin catalog.
.changeset/​patch-bump-awf-v0-29-6-mcpg-v0-5-2.md	Records the updated runtime dependency versions.

_{Review effort: Lite (auto)}

[Copilot]

@copilot resolve the merge conflicts on this branch.

Merged main and regenerated the six conflicted workflow lock files. Merge commit: a3aeb1c7c9.

[github-actions]

🎉 This pull request is included in a new release.

Release: v1.2.1