[gh-aw] Migrate workflows to Copilot PAT Pool

[vitek-karas]

Summary

• add the shared GH-AW Copilot PAT Pool import and onboarding README
• migrate android-reviewer and nightly-fix-finder to copilot-pat-pool and select COPILOT_PAT_0..9 via engine.env.COPILOT_GITHUB_TOKEN
• add validate-pat-pool.yml and regenerate the compiled lock files

Validation

• gh aw compile android-reviewer nightly-fix-finder --strict --schedule-seed dotnet/android

Security review note

• New restricted secrets: COPILOT_PAT_0, COPILOT_PAT_1, COPILOT_PAT_2, COPILOT_PAT_3, COPILOT_PAT_4, COPILOT_PAT_5, COPILOT_PAT_6, COPILOT_PAT_7, COPILOT_PAT_8, COPILOT_PAT_9
• Existing secret still used by nightly-fix-finder: ANDROID_TEAM_PAT
• Generated action manifest change reviewed: the regenerated lock files now reference github/gh-aw-actions/setup@v0.80.9 as part of the gh aw compile output, alongside the PAT-pool secret additions
• Reviewed these changes for intent and safety: the new PAT secrets are only consumed by the imported pat_pool job to choose a populated slot and by the case(...) expression that maps the selected slot into COPILOT_GITHUB_TOKEN; the workflow outputs continue to use the normal Actions tokens and do not expose PAT values

Follow-up

• this requires a copilot-pat-pool environment with COPILOT_PAT_0..9; nightly-fix-finder also needs ANDROID_TEAM_PAT available in that environment