fix: use converter-generated config instead of manual MCP config

Root cause: The gateway generates auth headers (HMAC-signed tokens) that
differ from the raw MCP_GATEWAY_API_KEY. The converter script
(convert_gateway_config_codex.cjs) correctly reads these from the
gateway output, but writes to ${RUNNER_TEMP}/gh-aw/mcp-config/ while
CODEX_HOME is /tmp/gh-aw/mcp-config — different paths.

Fix: Copy the converter's output (with correct auth headers and
172.30.0.1 resolved URLs) to CODEX_HOME, prepending the
shell_environment_policy that the converter doesn't generate.

Also update validation step to test with the converter's auth header
instead of the raw API key.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: lpcox