fix: avoid broad copilot matching in node preflight gate

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/345ed70b-1477-4fae-bb25-801df1d3fab2

Author: Copilot

containers/agent/entrypoint.sh

@@ -711,8 +711,8 @@ AWFEOF
 if ! command -v node >/dev/null 2>&1; then
   echo "[entrypoint][ERROR] Copilot CLI requires Node.js, but 'node' is not available inside AWF chroot."
   echo "[entrypoint][ERROR] Ensure Node.js is installed on the runner and reachable from PATH inside the chroot."
-  echo "[entrypoint][ERROR] Common locations: /opt/hostedtoolcache/... or \$HOME/.nvm/... (bind-mounted by AWF)."
-  echo "[entrypoint][ERROR] Verify \$HOME/.nvm exists on the host and contains an installed Node.js version."
+  echo "[entrypoint][ERROR] Common locations: /opt/hostedtoolcache/... or $HOME/.nvm/... (bind-mounted by AWF)."
+  echo "[entrypoint][ERROR] Verify $HOME/.nvm exists on the host and contains an installed Node.js version."
   exit 127
 fi
 AWFEOF

src/docker-manager.ts

@@ -817,11 +817,9 @@ export function generateDockerCompose(
 
   // Copilot CLI requires Node.js. Ask the agent entrypoint to fail fast with a
   // clear diagnostic if node is not reachable inside the chroot before startup.
-  if (
-    config.copilotGithubToken
-    || config.copilotApiKey
-    || /\bcopilot\b/i.test(config.agentCommand)
-  ) {
+  const commandExecutable = config.agentCommand.trim().split(/\s+/, 1)[0] || '';
+  const isCopilotCommand = /(^|\/)copilot$/i.test(commandExecutable);
+  if (config.copilotGithubToken || config.copilotApiKey || isCopilotCommand) {
     environment.AWF_REQUIRE_NODE = '1';
   }