feat: enable cli-proxy for smoke-services and firewall-issue-dispatcher (#1862)

* feat: enable cli-proxy for smoke-services and firewall-issue-dispatcher

Enable the cli-proxy feature for two Copilot-engine workflows that
heavily use the GitHub MCP server:

- smoke-services: I/O ratio 375:1, $0.89/run avg
- firewall-issue-dispatcher: I/O ratio 396:1, $0.51/run avg

The cli-proxy replaces MCP GitHub tool calls with gh CLI commands
via bash, avoiding the large MCP tool schemas that inflate context
on every turn. This should significantly reduce input token usage.

Both workflows compiled with gh-aw v0.67.4.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: add firewall-issue-dispatcher to post-processing targets

The firewall-issue-dispatcher lock file was using --image-tag/--skip-pull
which requires the cli-proxy image to be published to GHCR. Since the
cli-proxy image hasn't been released yet, the container failed to start
with 'No such image: ghcr.io/github/gh-aw-firewall/cli-proxy:0.25.18'.

Fix: Add firewall-issue-dispatcher.lock.yml to the post-processing
script's target list so it gets --build-local (builds from source).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: lpcox

.github/workflows/firewall-issue-dispatcher.lock.yml

@@ -11,6 +11,9 @@ permissions:
   issues: read
   pull-requests: read
 
+features:
+  cli-proxy: true
+
 tools:
   github:
     toolsets: [default]