Fall back to pinned Copilot CLI when live compatibility targets lack trusted checksums (#71339)

* Initial plan

* Fall back to pinned Copilot default when live compat target is unreviewed

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* Inline reviewed default Copilot checksum while preferring toolcache

Bind the compiler default CLI version to its reviewed manifest SHA256, resolve both constants from reviewed release pins, and reject missing default pins during compilation. Preserve cache-first installation with --prefer-toolcache while keeping explicit workflow pins download-only. Add actionable missing-pin remediation and cover compiler, resolver, cache, and musl behavior.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Recompile workflows with reviewed default Copilot checksum

Regenerate workflow lock files to inline the default Copilot CLI version, manifest SHA256, and cache-first installer flag.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <jhalleux@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: 3 people