Add model-routing smoke workflows with deterministic runner/proxy evidence checks - #67523

None of the 57 existing smoke workflows uses engine.model-routing, so routing bugs (#67487, #67509, sub-agent name attribution) only showed up in real runs. This PR adds three routed smokes. Each passes or fails on runner- and proxy-written evidence, not on the agent's reply.

Workflows (shared label_command: smoke-routing, plus schedule: every 2 days and workflow_dispatch)

• Each workflow uses a trivial task, a 10-minute timeout, and job-discriminator: ${{ github.run_id }}. create-issue is configured like the other smokes, with a separate close-older-key per workflow.
• smoke-copilot-sdk-routed depends on Fix Copilot SDK model routing and cross-family sub-agents #67509 (Copilot SDK providers per wire API). It is expected to fail until Fix Copilot SDK model routing and cross-family sub-agents #67509 merges.

Shared helper: actions/setup/js/smoke_model_routing_assertions.cjs

Each workflow calls the helper from an if: always() post-step. Post-steps run before the usage-artifact step, so the helper builds the unified session itself. It then reads aw_session.jsonl, the api-proxy token-usage.jsonl (same candidate paths as the #67509 post-step) and /reflect routing metadata.

Model IDs and endpoints are normalized before comparison. Real proxy logs contain provider-qualified and dated models (copilot-completions/…, claude-haiku-4-5-20251001) and query-suffixed paths (/v1/messages?beta=true).

Every failure prints its check ID and the observed values:

FAIL S3 sub-agent haiku-whoami: no 200 request for claude-haiku-4.5 on /chat/completions; observed: /responses 400
FAIL R1 routing not selected: runner-written routing status is missing, expected selected; no firewall model_routing selection record with a selected model (observed 0 selection record(s)); ignored agent-written model_routing.outcome (status=selected)

Post-step usage:

const { main } = require(path.join(process.env.RUNNER_TEMP, "gh-aw/actions/smoke_model_routing_assertions.cjs"));
await main({
  core, engine: "copilot", executionOutcome: process.env.SMOKE_EXECUTION,
  allowedModels: ["gpt-5.6-luna"], mainEndpoint: "/responses",
  subAgents: [{ name: "haiku-whoami", model: "claude-haiku-4.5", endpoint: "/chat/completions" }],
  requireDeclaredAgentNames: true,
});

Tests

smoke_model_routing_assertions.test.cjs uses synthetic aw_session.jsonl and token-usage.jsonl fixtures. It covers:

• a passing case for each variant;
• wrong model: selected model outside allowed-models, and a sub-agent running on another model;
• wrong endpoint, including the SDK sub-agent whose only request is /responses with status 400;
• non-200 status;
• missing selection event;
• harness-only routing outcome;
• classifier count of 0 or 2;
• missing or broken evidence files;
• an end-to-end case that builds the session from raw runner and proxy files.

Docs and generated files

• DEVGUIDE.md lists the three workflows and the smoke-routing label, and explains how to run them on a PR: add the label and approve the runs. To run them again, re-add the label, because label_command removes it.
• Lock files were generated by make recompile. agentic_commands.yml changed only to list the new label command.

Notes for reviewers

• The pi event names come from a real smoke-pi-sub-agents run (37735099783): subagent.started, subagent.configured and subagent.request, the same names the Copilot SDK uses. That run predates gh_aw_subagent_result, so it has no completion events. The current pi extension writes gh_aw_subagent_result, which maps to subagent.completed or subagent.failed.
• The pi GPT sub-agent's endpoint (/responses) is inferred from how pi handled gpt-5-mini in that run. If pi picks a different endpoint, S3 will fail and name the observed one.
• These workflows have not run in CI yet, so no checks have been compared against main. Following the scope rule, this PR will not fix failures that also occur on main.
• Routing, harness and AWF behavior are unchanged.

• Fixes Add model-routing smoke workflows with deterministic checks (routed Copilot CLI, routed pi, routed Copilot SDK) #67522