fix: allow workspace-relative read paths and add awk to go-source-analysis

The daily-compiler-quality workflow was hitting the tool denial limit (5/5)
because the Copilot SDK's `view` tool delivers file paths as absolute paths
(e.g. /home/runner/work/gh-aw/gh-aw/pkg/workflow/file.go) but the
go-source-analysis shared import only grants shell(cat pkg/**/*.go) — a
workspace-relative glob.

The isReadPathAllowedByShellRules permission function did not know about the
workspace root, so it could not strip the GITHUB_WORKSPACE prefix before
matching against the relative pattern, causing every view() call to be
denied (3 denials). The agent then fell back to Python heredocs which are
also denied (2 more denials → limit hit).

Fixes:
1. copilot_sdk_permissions.cjs: Add optional workspaceRoot parameter to
   isReadPathAllowedByShellRules. When the requested path is absolute and
   the pattern is relative, try matching the path after stripping the
   workspace prefix.
2. buildCopilotSDKPermissionHandler: Accept workspaceRoot in options and
   thread it through to the read permission check.
3. copilot_sdk_session.cjs: Pass process.env.GITHUB_WORKSPACE as
   workspaceRoot when building the permission handler.
4. go-source-analysis.md: Add awk to bash tools as a capable non-Python
   alternative for complex text analysis (e.g. function-length counting).
5. Recompile daily-compiler-quality, duplicate-code-detector,
   semantic-function-refactor, and spec-extractor (all import
   go-source-analysis.md).

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

.github/workflows/daily-compiler-quality.lock.yml

@@ -12,6 +12,7 @@ tools:
   - head -n * pkg/**/*.go
   - grep -r "func " pkg --include="*.go"
   - cat pkg/**/*.go
+  - awk
 ---
 ## Go Source Code Analysis Setup