GHES 400 bad request: Authorization header is badly formatted

[jaroslawgajewski]

Following up here since this is where the original diagnosis happened (thanks again for
the fast turnaround back in June, @lpcox).

We finally got a clean live re-test of #5415 / AWF v0.27.9+ on a GHES +
Copilot Business setup with the same configuration as before, and the bug is still
present.

What we tested

For several days we ran one workflow as a live canary on native, unpinned AWF (v0.27.13,
then v0.27.16 after a compiler bump) specifically to re-validate this fix — everything
else stayed pinned to the old AWF v0.25.55 that predates the bug. Config is unchanged
from what was described in this issue in June: COPILOT_API_TARGET set to the Copilot
Business endpoint (not the Enterprise one), GITHUB_SERVER_URL pointing at a *.ghe.com
instance, no BYOK/custom provider.

Result

Over dozens of pull_request-triggered runs of the canary across several days:

• The large majority failed (well above half)
• Every failure sampled shows the identical error, across all retry attempts:

  400 400 bad request: Authorization header is badly formatted
  

• This includes failures after ruling out and fixing an unrelated blocker (the
  SUPPORTED_COPILOT_MODELS allowlist rejecting a newer model — separately reported and
  fixed as SUPPORTED_COPILOT_MODELS allowlist in src/copilot-model.ts is out of sync with docs/model-api-mapping.json — rejects valid models as "retired" #5752 — which had briefly masked whether the canary was even
  reaching a real auth attempt).
• A fresh, deliberate confirmation run just today still failed with the same error,
  immediately, on the very first Copilot CLI attempt.

So copilotTargetRequiresGitHubTokenPrefix()'s handling of the Business API target on
*.ghe.com doesn't appear to be taking effect here, or there's some other path that
still sends the malformed header for this target. We've retired the canary and gone back
to pinning AWF to v0.25.55 (which has no auth-header issue)

Version info:

• gh-aw-firewall: v0.27.13 and v0.27.16 (both reproduce)
• gh-aw compiler: v0.82.0 / v0.82.1
• Copilot CLI: 1.0.65