fix: capture Copilot CLI session state (events.jsonl) in AWF sandbox artifacts (#1945)

* Initial plan

* fix: capture Copilot CLI session state (events.jsonl) in AWF artifacts

Add --session-state-dir to AWF invocations and replace the
copy_copilot_session_state.sh step with an inline script that
reads from the AWF-managed host path instead of $HOME/.copilot/
session-state (which is empty when CLI ran inside the container).

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/6833d315-fdff-4cf9-b5a6-7e322a307397

* chore: merge main into branch, resolve security-guard conflict

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/d5c1499d-ca46-4260-9a15-4f8ad5f1b306

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: Copilot