Top-level environment: frontmatter is not propagated to the detection job #38900

Summary

When a workflow's source .md declares a top-level environment: (intended to scope all jobs that consume secrets to a GitHub Environment with protection rules), the v0.79.6 compiler propagates it to agent, conclusion, pre_activation, and safe_outputs — but not to the detection job. The detection job continues to inject COPILOT_GITHUB_TOKEN from secrets.* directly into its job env without any environment scoping.

Repro

Source .md frontmatter:

---
on:
  slash_command:
    name: review
    events: [pull_request_comment]
  roles: [admin, maintainer, write]
environment: my-env
engine:
  id: copilot
  model: claude-opus-4.6
safe-outputs:
  create-pull-request-review-comment:
    max: 50
  submit-pull-request-review:
    max: 1
    allowed-events: [COMMENT, REQUEST_CHANGES]
---

# Reviewer
...

Run gh aw compile (or gh aw upgrade) with gh aw v0.79.6.

Expected

Every job in the regenerated *.lock.yml that consumes a non-GITHUB_TOKEN secret has environment: my-env.

Actual

  agent:
    runs-on: ubuntu-latest
    environment: my-env       # ✅
    ...

  conclusion:
    runs-on: ubuntu-latest
    environment: my-env       # ✅
    ...

  detection:
    needs:
      - activation
      - agent
    runs-on: ubuntu-latest
    # ❌ no environment: my-env
    permissions:
      contents: read
    ...
    steps:
      - ...
        env:
          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}    # secret pulled without env scoping

  pre_activation:
    runs-on: ubuntu-slim
    environment: my-env       # ✅

  safe_outputs:
    runs-on: ubuntu-slim
    environment: my-env       # ✅

The detection job pulls COPILOT_GITHUB_TOKEN (and runs a second Copilot pass for threat detection) but is missing the environment: declaration that every other secret-consuming job got.

Impact

Users who add environment: to their .md to require approvals / restrict to protected branches before secrets are exposed will silently still be running the detection phase outside that gate. The job already includes --exclude-env COPILOT_GITHUB_TOKEN to keep the token out of the sandboxed agent process, but it remains in the GHA job env (line COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}), so the environment protection rule is bypassed for that phase.

This forces users to hand-patch the .lock.yml after every gh aw upgrade / gh aw compile, contradicting the "DO NOT EDIT" notice on the file.

Suggested fix

In pkg/workflow (wherever the per-job environment: propagation happens), apply the same logic to the detection job emitter that's used for agent / conclusion / safe_outputs.

Version

gh aw version v0.79.6