Mount golangci-lint in agent sandboxes and short-circuit missing-tool/time-budget loops in Avenger/Tidy

[Copilot]

Avenger and Tidy were repeatedly burning turn/time budget rediscovering that golangci-lint is unavailable in the sandbox and cannot be installed due to blocked egress. This change removes that failure loop by making lint availability deterministic and tightening fallback behavior to avoid unnecessary long-running work.

• Sandbox/tooling availability

  • Mounts a read-only golangci-lint binary in the agent sandbox (same mount pattern as existing make/go mounts), so make golint can run without runtime install attempts.

• Workflow prompt hardening (Avenger + Tidy)

  • Updates workflow instructions to:
    • avoid go install ...golangci-lint in sandboxed runs,
    • perform a single non-interactive availability check,
    • skip make golint cleanly when the binary is absent instead of retrying install paths.

• Budget protection in Tidy

  • Adjusts Tidy execution flow to avoid spending remaining step budget on full test runs when no repository changes were produced.
  • Prevents the prior “no-op + full test + timeout” pattern in the fixed 10-minute Copilot step.

# New deterministic check pattern used by workflow logic
if command -v golangci-lint >/dev/null 2>&1; then
  make golint
else
  echo "golangci-lint not available in sandbox; skipping golint"
fi

• Fixes [aw-failures] Avenger & Tidy: golangci-lint unavailable in agent sandbox burns turn/time budget → invocation-cap and step-timeou [Content truncated due to length] #50567