Bump firewall to v0.27.9 and mcpg to v0.3.29

[lpcox]

Summary

Bump the pinned default versions in pkg/constants/version_constants.go:

Constant	Current	New
DefaultFirewallVersion	v0.27.7	v0.27.9
DefaultMCPGatewayVersion	v0.3.27	v0.3.29

Releases

• gh-aw-firewall v0.27.9 — https://github.com/github/gh-aw-firewall/releases/tag/v0.27.9
• gh-aw-mcpg v0.3.29 — https://github.com/github/gh-aw-mcpg/releases/tag/v0.3.29

Why

• Firewall v0.27.9 (over v0.27.7) notably fixes the api-proxy Copilot Business auth prefix (use token auth prefix for the Copilot Business endpoint, Refactor oversized test files into focused, maintainable modules #5415) and de-flakes the docker-host staging tests (parallel-worker race on /tmp/gh-aw, Verify safe-output pattern consistency is already complete #5467). Includes the gh-aw v0.81.0 recompile and extensive api-proxy/host-iptables refactors.
• MCPG v0.3.29 (over v0.3.27) adds an opt-in observed URL domain audit pipeline for tool responses and write sinks ([docs] Reduce bloat in project-management.md (40% reduction) #7987), improved OTel GenAI span semantics / DIFC visibility, additional DIFC guard coverage for CLI-only mutating operations, wazero v1.12.0 upgrade, and centralized TLS config hardening.

Changes required

1. Update pkg/constants/version_constants.go:
   • DefaultFirewallVersion → v0.27.9
   • DefaultMCPGatewayVersion → v0.3.29
2. Re-pin container image digests (firewall agent/squid/api-proxy/cli-proxy and the mcpg image) wherever digests are recorded (pkg/workflow/data/action_pins.json / pkg/actionpins/data/action_pins.json, lock files).
3. Recompile workflows so .lock.yml files pick up the new image tags + digests.
4. Add a changeset (e.g. .changeset/patch-bump-awf-v0-27-9-mcpg-v0-3-29.md) following the existing naming convention.
5. Run tests (pkg/constants/spec_test.go, firewall pin compile tests) to validate.