fix: escape MCP env secrets with \${VAR} for non-Copilot engines to prevent heredoc JSON corruption

cmd/gh-aw/format_list_test.go

@@ -46,7 +46,6 @@ func TestFormatListWithOr(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			result := formatListWithOr(tt.items)

pkg/workflow/README.md

@@ -1540,7 +1540,6 @@ This appendix is generated from the current non-test Go source files in this pac
 | `secret_extraction.go` | `ExtractEnvExpressionsFromValue` | `func ExtractEnvExpressionsFromValue(value string) map[string]string` | ExtractEnvExpressionsFromValue extracts all GitHub Actions env expressions from a string value Returns a map of environment variable names to their full env expressions Examples: - "${{ env. |
 | `secret_extraction.go` | `ExtractSecretsFromMap` | `func ExtractSecretsFromMap(values map[string]string) map[string]string` | ExtractSecretsFromMap extracts all secrets from a map of string values Returns a map of environment variable names to their full secret expressions Example: Input: {"DD_API_KEY": "${{ secrets. |
 | `secret_extraction.go` | `ExtractWorkflowInputExpressionsFromValue` | `func ExtractWorkflowInputExpressionsFromValue(value string) map[string]string` | ExtractWorkflowInputExpressionsFromValue extracts simple workflow input expressions from a string value and maps them to deterministic environment variable names. |
-| `secret_extraction.go` | `ReplaceSecretsWithBashVars` | `func ReplaceSecretsWithBashVars(value string) string` | ReplaceSecretsWithBashVars replaces secret expressions in a value with bash env var references. |
 | `secret_extraction.go` | `ReplaceTemplateExpressionsWithEnvVars` | `func ReplaceTemplateExpressionsWithEnvVars(value string) string` | ReplaceTemplateExpressionsWithEnvVars replaces all template expressions with environment variable references Handles: secrets. |
 | `secret_masking.go` | `(*Compiler).MergeSecretMasking` | `func (*Compiler).MergeSecretMasking(topConfig *SecretMaskingConfig, importedSecretMaskingJSON string) (*SecretMaskingConfig, error)` | MergeSecretMasking merges secret-masking configurations from imports with top-level config |
 | `service_ports.go` | `ExtractServicePortExpressions` | `func ExtractServicePortExpressions(servicesYAML string) (string, []string)` | ExtractServicePortExpressions parses the services: YAML string from WorkflowData. |