Allow CI scanner shell built-ins and extend inactivity watchdog - #135417

Why this change is needed

CI Outer-Loop Failure Scanner run 37487931212 fetched the build lists for all 36 pipelines, but could not execute its timeline-fetch command because read was missing from the Bash command allowlist. The agent used while read -r build to consume build IDs produced by jq; this is piped-data processing, not interactive input.

Local Docker reproduction exposed two further obstacles: the agent also used Bash's : no-op builtin in a loop, which was denied, and the default two-minute inactivity watchdog interrupted an active but quiet log-fetch command. That watchdog starts after the first issue output, even though the scanner may still have more failures to investigate. The interrupted run returned exit code 0, so its exit status alone did not establish that the scan completed.

Changes

• Allow the read and : builtins used by the observed scanner commands.
• Extend the inactivity watchdog from two to ten minutes. This mitigates premature interruption of quiet work; it does not fix the framework's scan-completion detection. The overall 90-minute limit and 2,500-credit cap remain unchanged.
• Regenerate the locked workflow with the existing pinned gh-aw v0.86.2 compiler. The prompt and version pins are unchanged. Regeneration also normalizes the compiler's inactive failure-issue expiry default to 168 hours; failure-issue reporting remains disabled.

Validation

Full end-to-end completion remains unverified. The last Docker scan was stopped after a defect in the local runner let it exceed its intended 90-minute deadline; some CI evidence was also unavailable. The local deadline handling was corrected separately and regression-tested, but that runner is not included in this patch. Docker validation exercised the agent job only, and no issues were published. The ad hoc validation scripts and fixtures are session-local, not part of this PR.