Pin AWF Docker image version using --image-tag flag (#7014)

* Initial plan

* Add --image-tag flag to AWF commands to pin Docker image version

This change ensures AWF uses a pinned Docker image version matching
the installed binary version, rather than pulling the latest image.

- Add getAWFImageTag() helper function in firewall.go
- Update copilot_engine.go to add --image-tag flag to AWF args
- Update claude_engine.go to add --image-tag flag to AWF args
- Update codex_engine.go to add --image-tag flag to AWF args
- Add tests for image tag functionality in all engines
- Recompile all workflow lock files

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

* Remove v prefix from --image-tag version argument

AWF expects the image tag without the 'v' prefix (e.g., 0.7.0 instead
of v0.7.0). Updated getAWFImageTag() to strip the 'v' prefix using
strings.TrimPrefix. Updated tests to expect versions without prefix.

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
Co-authored-by: Jiaxiao Zhou <duibao55328@gmail.com>

Author: Copilot