[awf] Bump mcpg to v0.3.23 and firewall to v0.25.65

[lpcox]

Request

Bump the following component versions in the gh-aw compiler/lock file generation:

mcpg: v0.3.22 → v0.3.23

Release: https://github.com/github/gh-aw-mcpg/releases/tag/v0.3.23

Highlights:

• Debug logging for unified server functions and tracing span helpers
• Refactored pagination/map-extraction and rate-limit helpers
• Centralized formatErrorContext schema guidance
• New tests for config.LoadFromStdin, server.copyToolCallLimits, proxy package
• Documented --otlp-sample-rate in tracing docs

Image: ghcr.io/github/gh-aw-mcpg:v0.3.23

---

AWF (firewall): v0.25.63 → v0.25.65

Release: https://github.com/github/gh-aw-firewall/releases/tag/v0.25.65

Highlights:

• feat: AI credits accounting and --max-ai-credits enforcement in API proxy ([copilot-agent-analysis] Daily Copilot Agent Analysis - 2025-11-19 #4357)
• feat: Tool cache mount detection moved into AWF with stdin config schema support (🎯 Repository Quality Improvement - Workflow Compilation Error Messages #4329)
• feat: ARC/DinD zero-config gaps closed — chroot identity, DinD staging, MCP Docker host propagation (Assign command groups to organize CLI help output #4400)
• feat: Copilot session_id opt-in via awf config spec/schema (Update CLI versions: Claude Code 2.0.46, Copilot CLI 0.0.361 #4340)
• fix: Symlink cleanup in tool-cache mount test (Rename "Status" to "Labs" in docs navigation menu #4348)
• fix: Placeholder test path for copilot-byok module ([tidy] Fix formatting in command_groups_test.go #4410)
• fix: spec duplicate maxPermissionDenied entry (📊 Agentic Workflow Lock File Statistics - November 20, 2025 #4372)
• refactor: Copilot provider split into BYOK and auth modules (Add "Why Compile?" explanation to Quick Start guide #4394)
• refactor: OpenTelemetry split into serialization/exporter modules ([task] Add explanation of why compilation is needed #4393)
• refactor: WrapperConfig type composition cleanup ([task] Define "agentic" and create glossary for key terms #4392)
• ci: smoke-copilot-byok-aoai-apikey workflow (Update smoke test workflows to use add-comment and add comprehensive capability testing #4352)
• ci: Bump smoke-copilot-byok model to claude-opus-4.8 (Add type field to safe output configs and update instructions #4355)

Images:

ghcr.io/github/gh-aw-firewall/agent:0.25.65
ghcr.io/github/gh-aw-firewall/api-proxy:0.25.65
ghcr.io/github/gh-aw-firewall/squid:0.25.65
ghcr.io/github/gh-aw-firewall/cli-proxy:0.25.65

All images are cosign-signed and published to GHCR.