Pi engine streaming log is written to a read-only path on runner.topology arc-dind (#63717 follow-up) #69406

Analysis

Follow-up to #63717 and gh-aw-firewall#9188, which concluded that moving Pi's streaming log to a writable path needs a gh-aw compiler change. As of v0.92.3 it has not happened.

• pkg/workflow/pi_engine.go: PiStreamingLogFile = "/tmp/gh-aw/pi-streaming.jsonl", used by the tee in the Pi run command.
• With runner.topology: arc-dind, /tmp/gh-aw becomes ${RUNNER_TEMP}/gh-aw mounted read-only; pkg/workflow/awf_command_builder.go makes only .../sandbox/agent writable. The compiled lock still runs tee ${RUNNER_TEMP}/gh-aw/pi-streaming.jsonl, so the tee fails and, with pipefail, a successful Pi run exits 1.
• The Copilot engine already writes logs under /tmp/gh-aw/sandbox/agent/logs/ (copilot_engine.go).

Workaround today, in every Pi workflow on ARC/DinD: a pre-step that touches the file and symlinks /tmp/gh-aw/pi-streaming.jsonl, plus a sandbox.agent.mounts rw entry for it.

Implementation Plan

1. pkg/workflow/pi_engine.go: set PiStreamingLogFile to /tmp/gh-aw/sandbox/agent/logs/pi-streaming.jsonl, consistent with the Copilot engine.
2. Update the consumers of the old path: the Pi step-summary log parsing, actions/setup/js/unified_session.cjs, actions/setup/js/pi_session_export.cjs, and the agent artifact paths.
3. Test: under runner.topology: arc-dind, the compiled Pi log path is inside a writable mount.
4. Run make agent-finish before completing.

Acceptance Criteria

A Pi workflow with runner.topology: arc-dind and no extra mounts or pre-steps succeeds, and its step summary and session artifacts include the streaming log.