Add sandbox-sudo-false-rollout workflow

[Copilot]

Introduces a workflow_dispatch agentic workflow to incrementally roll out sandbox.agent.sudo: false (rootless/network-isolation AWF mode) across this repository's workflows — starting with 25% of those currently opting in to sudo: true.

What the workflow does

• Parses YAML frontmatter (Python, not grep) to find all .md workflows with sandbox.agent.sudo: true — avoids false positives from prose/code in prompt bodies
• Selects ⌈N × 0.25⌉ files (alphabetical sort → deterministic; currently 64 eligible → 16 selected)
• Skips files with >1 sudo: true occurrence in frontmatter (ambiguous)
• Flips sudo: true → sudo: false, then recompiles each via gh aw compile to regenerate the .lock.yml with --rootless AWF mode
• Opens a draft PR scoped to *.md + *.lock.yml under .github/workflows/

Permissions note

Uses allow-workflows: true + shared/app-config.md (GitHub App) because workflows:write cannot be granted via GITHUB_TOKEN.