Make threat-detect binary install step continue-on-error in warn mode

[Copilot]

A GitHub Releases CDN blip caused the evals/detection job installers for the AWF firewall and threat-detect binaries to fail across multiple PR-gate workflows within a 25-minute window. The threat-detect binary download already had retry-with-backoff (curl --retry 5 --retry-delay 10 --retry-max-time 180), but a hard failure after retries still marked the whole detection job as failure — even though the job's own logic (GH_AW_DETECTION_CONTINUE_ON_ERROR) already treats a missing threat-detect binary as non-fatal in warn mode.

Compiler change

• buildInstallThreatDetectStep now takes *WorkflowData and emits continue-on-error: true (or the configured expression) for the "Install threat-detect binary" step, reusing the same continue-on-error resolution already applied to the detection conclusion/analysis steps:

- name: Install threat-detect binary
  if: always() && steps.detection_guard.outputs.run_detection == 'true'
  continue-on-error: true
  run: |
    bash "${RUNNER_TEMP}/gh-aw/actions/install_threat_detect_binary.sh" latest

This keeps the install step's failure semantics consistent with the job's existing tolerance policy: in warn mode a transient download failure no longer flips the job conclusion to failure; in strict mode (continue-on-error: false) the step still fails the job as before.

Test coverage

• threat_detection_isolation_test.go: added an assertion in TestExternalDetectorPath verifying the install step carries continue-on-error: true in the default warn mode.

Generated workflows

• Recompiled all .lock.yml files; 104 workflows using features: gh-aw-detection: true pick up the new continue-on-error: true line on this step.

• Fixes [aw-failures] [P0] Harden AWF/threat-detect binary installers against transient GitHub Releases connection failures #52397

[github-actions]

PR Triage

Category: chore | Risk: low | Priority: low | Score: 31/100

Score breakdown: impact 15/50, urgency 8/30, quality 8/20

CI: unknown (draft)

Recommended action: defer

CI hardening chore, still draft/blocked.

_{Automated triage — run 52400}

Generated by 🔧 PR Triage Agent · auto · 67.2 AIC · ⌖ 2.77 AIC · ⊞ 7.8K · ◷