[WIP] Fix Copilot provider-proxy authorization for daily max AI credits test

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>[aw-failures] Daily Max Ai Credits Test: Copilot provider-proxy 403 blocks every run (billing/permission gap)</issue_title>
<issue_description>Fix the Copilot provider-proxy authorization for permissions.copilot-requests: write on this workflow — it has failed every single scheduled run for at least 8 days straight (10/10 runs since 2026-07-27), 100% failure rate, zero prior tracking.

Affected workflow / run

• Workflow: Daily Max Ai Credits Test (.github/workflows/daily-max-ai-credits-test.lock.yml)
• Failed run: §30906430299, 2026-08-04T11:49:35Z, job 91982619228, step "Execute GitHub Copilot CLI"
• Same-signature streak: 10/10 consecutive scheduled-run failures back to §30265162193 (2026-07-27) — no success in this window.

Probable root cause

Raw job log:

Authentication failed with provider at (172.30.0.30/redacted) (HTTP 403).
  Check your COPILOT_PROVIDER_API_KEY or COPILOT_PROVIDER_BEARER_TOKEN.
...
[copilot-harness] attempt 2: Copilot requests authentication failed through the gh-aw API proxy (HTTP 403, model=claude-sonnet-5, stage=starting the Copilot CLI request). This workflow is using permissions.copilot-requests: write, so Copilot requests must be allowed through your organization's centralized Copilot billing configuration. Verify that copilot-requests: write is granted to the workflow or job and that Copilot org billing is enabled for your organization.
 — not retrying

audit-diff vs the prior day's failure (§30812833453) shows 0 firewall/domain drift, 0 anomalies — rules out a sandbox/network regression. This is an application-level 403 from the internal Copilot billing/auth proxy, and it is fully deterministic (every run hits it).

Proposed remediation

• Confirm copilot-requests: write is actually granted to this workflow/job — compare against another workflow using the same permission that succeeds, if one exists.
• Confirm the organization's centralized Copilot billing configuration covers this workflow/repo — the harness error points directly at billing config, not application code.
• Once changed, verify against several consecutive scheduled runs given this has silently failed for over a week.

Success criteria

• Run completes without an HTTP 403 from `(172.30.0.30/redacted)
• 3+ consecutive scheduled runs succeed.

Related to #50077
Related to #50077

Generated by 🔍 [aw] Failure Investigator (6h) · agent · 232.9 AIC · ⌖ 42.2 AIC · ⊞ 5.2K · ◷

• expires on Aug 11, 2026, 5:40 AM UTC-08:00

• Closes [aw-failures] Daily Max Ai Credits Test: Copilot provider-proxy 403 blocks every run (billing/permission gap) #50272

Comments on the Issue (you are @copilot in this section)

• Fixes [aw-failures] Daily Max Ai Credits Test: Copilot provider-proxy 403 blocks every run (billing/permission gap) #50272