Make Copilot wire-API routing compatible with subagent tool requests #9558

Problem

Two gh-aw routing-sandbox runs show Copilot subagent requests failing with HTTP 400 after the firewall allowed the upstream connection:

• Run 37527660131: the quick-checker subagent was configured with gpt-5.4-mini and failed with model "gpt-5.4-mini" is not accessible via the /chat/completions endpoint.
• Run 37573465105: the same subagent/model failed with Cannot translate Copilot request feature 'tools[custom]' between Responses and Chat Completions.

Both runs completed their agent and safe-output jobs, but could not complete the delegated check. Firewall telemetry shows successful CONNECTs to api.githubcopilot.com:443; this is not an egress allowlist or container-startup failure. The failure occurs at Copilot model/endpoint compatibility. AWF's API proxy currently documents that custom tool definitions may not translate between wire APIs, and a Copilot model may reject the endpoint selected for it.

AWF version and the exact model-routing configuration used by these runs are not established from the available logs.

Possible solution

Make Copilot wire-API selection account for both model endpoint support and the request's features before dispatch. Prefer the endpoint that can preserve the request (including custom tools) instead of attempting a lossy translation; when that endpoint/model combination is unavailable, return a clear, actionable compatibility error or select another model only under an explicit fallback policy. Add proxy-level regression coverage for both the endpoint-rejection response and a tools[custom] request so these cases cannot silently break subagent work again.

Relevant implementation/docs: containers/api-proxy/wire-api-compat.js, containers/api-proxy/upstream-retry.js, and the “Copilot Wire API Translation” section in docs/api-proxy-sidecar.md.