fix: add /tmp/gh-aw bind mount to safeoutputs MCP container (#39950)

* Initial plan

* fix: add DefaultTmpGhAwMount to safeoutputs MCP container mounts

The safeoutputs MCP container was missing the /tmp/gh-aw bind mount,
causing patch/bundle files written inside the container to be destroyed
when the container exited (--rm). The host runner's /tmp/gh-aw never
received them, so collect_ndjson_output.cjs found nothing and
safe_outputs failed with "No patch file found".

Add constants.DefaultTmpGhAwMount to the mounts array in both:
- renderSafeOutputsTOML (TOML path for Codex/Claude)
- renderSafeOutputsMCPConfigWithOptions (JSON path for Copilot/Claude)

This matches how other MCP servers (agenticworkflows) already include
DefaultTmpGhAwMount in their mounts.

Fixes: #39948

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* recompile

* Add changeset for safeoutputs tmp mount fix

* simplify mounts

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: 3 people