Fix gh aw update dropping object-form (uses/with) imports

[Copilot]

gh aw update could silently replace a valid imports: collection with imports: [] when the only entries were object-form (e.g. - uses: shared/control.md with a with: map). This broke nested import chains and caused their generated steps (e.g. Precompute control facts) to disappear from the recompiled lock file, even though the upstream import was unchanged.

Root cause

• processImportsWithWorkflowSpec (pkg/cli/imports.go) rewrites imports: entries to workflowspec format (owner/repo/path@sha) during updates and merges.
• It relied on collectStringImports, which only extracted plain-string entries from the imports array and silently dropped object-form entries (uses/with, path/inputs).
• When a workflow's only import was object-form, the rewritten list ended up empty.

Fix

• Replaced collectStringImports + processImportPaths with processImportItems, which handles every entry type:
  • string entries are rewritten to workflowspec format as before
  • object entries keep their shape — only the path/uses value is rewritten, inputs/with and any other keys are preserved
  • unrecognized entry types pass through unchanged instead of being dropped
• Applies uniformly to both the plain-array and object (aw: subfield) forms of imports, and guarantees the output list is never shorter than the input — preventing a non-empty imports collection from silently collapsing to [].

imports:
  - uses: shared/control.md
    with:
      role: orchestrator
      rollout_mode: ${{ vars.CENTRAL_AGENTIC_OPS_DEPENDABOT_MODE || 'preview' }}

This entry now survives an update/merge intact instead of vanishing.

Tests

• TestProcessImportsWithWorkflowSpec_ObjectFormPreserved — object-form import with with fields survives rewriting.
• TestMergeWorkflowContent_PreservesUnchangedObjectFormImports — three-way merge scenario where only the upstream prompt body changes and nested frontmatter imports remain unchanged.

• Fixes Update workflows cmd replaces valid workflow imports #53703

[mnkiefer]

@copilot Please address the remaining merge blockers on this PR, then run the pr-finisher skill and report back with validation results and any remaining blockers.

[Copilot]

@copilot Please address the remaining merge blockers on this PR, then run the pr-finisher skill and report back with validation results and any remaining blockers.

Fixed the merge blocker: CI's lint-go job was failing on a modernize: mapsloop finding in pkg/cli/imports.go (manual map-copy loop instead of maps.Copy), introduced by the object-form imports fix. Addressed in 1900438.

pr-finisher validation:

• ✅ Reviews — no unresolved review threads; PR already approved by @mnkiefer.
• ✅ Checks (local) — make golint-incremental BASE_REF=origin/main now reports 0 issues; targeted tests (TestProcessImportsWithWorkflowSpec_*, TestMergeWorkflowContent_*) and full TEST_UNIT_RUN_FULL=1 make test-unit all pass.
• ❓ Checks (CI) — stale after this push (new HEAD 1900438 has no status checks yet); needs a maintainer to re-trigger (close/reopen, workflow_dispatch, or a new push). The prior lint-go failure is fixed and locally reproduced/verified.
• ✅ Mergeable — PR is open, not draft, approved, no conflicts; mergeable_state: blocked reflects pending/stale required checks on the new commit, not a real conflict.

Nothing else is actionable from this agent; ready for a maintainer to re-trigger CI and merge.