Bump gh-aw-firewall (AWF) to v0.28.17

[lpcox]

Summary

Bump the pinned github/gh-aw-firewall (AWF) version from v0.28.16 to v0.28.17.

Current state

• DefaultFirewallVersion in pkg/constants/version_constants.go is currently v0.28.16.

What's changed upstream (v0.28.16...v0.28.17)

Full changelog: github/gh-aw-firewall@v0.28.16...v0.28.17

• [docs] auth: Cross-reference Copilot auto model prefix-stripping in authentication-architecture (Reduce daily team status issue expiration from 3d to 1d #8505)
• chore(workflows): upgrade gh-aw to v0.89.10 (Add glossary links and inline explanations for technical terms #8510)
• refactor: split cloud-hypervisor cleanup registry into focused modules ([ci-coach] Fix missing awmg integration test coverage and optimize CI matrix #8519)
• Refactor Cloud Hypervisor runtime backend into focused modules (Add charts and visualization to daily-code-metrics workflow #8518)
• chore: upgrade gh-aw workflows to v0.89.13 (🏥 Safe Output Health Report - 2026-01-01 #8530)
• Preserve redacted upstream non-2xx payloads and correlation metadata in API proxy audit logs (Add validation for gatewayed MCP servers in health check #8550)
• Append broker-generated repository scope to enclave agent prompts ([plan] Add completion descriptions for workflow names using CompletionWithDesc #8553)
• fix: preserve API proxy log cleanup permissions ([security-fix] Fix incorrect file permissions in compile_orchestrator.go (Alert #384) #8562)

Tasks

• Update DefaultFirewallVersion (and any AWF*MinVersion constants if needed) in pkg/constants/version_constants.go
• Review release notes for new/removed flags, schema/config changes, and security fixes that may need corresponding gh-aw updates
• Run the AWF rebuild flow: make build, then make recompile twice to refresh image SHA pins
• Run focused validation on AWF-related Go code and tests
• Add a changeset if the bump changes shipped behavior

Related skill: .github/skills/awf-release-integrator/SKILL.md