legacy-security: enable emits `sudo -E awf` but installs awf with --rootless, so the agent fails at startup with `sudo: awf: command not found`

[Calidus]

gh-aw version: v0.83.1 (v0.83.2 only bumps container versions, so it should reproduce there too)
AWF version: v0.27.38
Engine: claude · Runner: ubuntu-latest (GitHub-hosted)

Summary

Opting a workflow into legacy security mode per the migration notes in #45360 produces a lock file whose agent job cannot start: the AWF execution command uses sudo -E awf, but the install step installs the binary with --rootless into ~/.local/bin, which is not on sudo's secure_path. The agent job dies immediately with:

sudo: awf: command not found

and the run fails with ERR_CONFIG: Claude execution failed: no structured log entries were produced. Claude startup failed before structured logging.

Reproduction

1. Add the opt-in from feat: default to strict security mode, stop injecting sudo and --enable-host-access #45360 to any workflow frontmatter:

sandbox:
  agent:
    id: awf
    legacy-security: enable

2. gh aw compile with v0.83.1.

3. Inspect the generated .lock.yml — the two steps disagree:

# agent job, "Install awf" step:
run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.38 --rootless

# agent job, "Execute Claude Code CLI" step:
sudo -E awf --config ... --legacy-security --enable-host-access --allow-host-ports 80,443,8080 ...

4. Run the workflow. install_awf_binary.sh --rootless installs to ${HOME}/.local/bin (per the script's rootless branch); sudo resets PATH to secure_path, which doesn't include it. Startup fails.

Root cause

BuildAWFArgs/GetAWFCommandPrefix correctly switch to the legacy (sudo -E awf) invocation when LegacySecurity is set (#45360), but the install-step emission still passes --rootless unconditionally in the agent job. Notably, the same lock file's detection job installs without --rootless — the compiler already emits both forms; the agent job's install step just doesn't account for legacy mode.

Expected

When legacy-security: enable is set, the agent job should install awf without --rootless (i.e., to /usr/local/bin via sudo), matching the sudo -E awf invocation.

Context / impact

We have workflows whose egress requires host network access on the runner (the use case legacy-security exists for). Strict mode's rootless topology breaks them at runtime, and the documented opt-in is unusable due to this bug — the only workaround we found is pinning the compiler to a pre-v0.82.10 release.