fix: tighten copilot executable detection for node preflight

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/345ed70b-1477-4fae-bb25-801df1d3fab2

Author: Copilot

containers/agent/entrypoint.sh

@@ -711,8 +711,8 @@ AWFEOF
 if ! command -v node >/dev/null 2>&1; then
   echo "[entrypoint][ERROR] Copilot CLI requires Node.js, but 'node' is not available inside AWF chroot."
   echo "[entrypoint][ERROR] Ensure Node.js is installed on the runner and reachable from PATH inside the chroot."
-  echo "[entrypoint][ERROR] Common locations: /opt/hostedtoolcache/... or $HOME/.nvm/... (bind-mounted by AWF)."
-  echo "[entrypoint][ERROR] Verify $HOME/.nvm exists on the host and contains an installed Node.js version."
+  echo "[entrypoint][ERROR] If using setup-node or nvm, verify the install path is present and bind-mounted into /host."
+  echo "[entrypoint][ERROR] Example locations include /opt/hostedtoolcache/... and $HOME/.nvm/..."
   exit 127
 fi
 AWFEOF

src/docker-manager.ts

@@ -818,7 +818,8 @@ export function generateDockerCompose(
   // Copilot CLI requires Node.js. Ask the agent entrypoint to fail fast with a
   // clear diagnostic if node is not reachable inside the chroot before startup.
   const commandExecutable = config.agentCommand.trim().split(/\s+/, 1)[0] || '';
-  const isCopilotCommand = /(^|\/)copilot$/i.test(commandExecutable);
+  const commandExecutableBase = path.posix.basename(commandExecutable.replace(/\\/g, '/'));
+  const isCopilotCommand = commandExecutableBase.toLowerCase() === 'copilot';
   if (config.copilotGithubToken || config.copilotApiKey || isCopilotCommand) {
     environment.AWF_REQUIRE_NODE = '1';
   }