chore: bump Agent Workflow Firewall (AWF) from v0.25.18 to v0.25.19

[lpcox]

Summary

Bump DefaultFirewallVersion from v0.25.18 to v0.25.19.

Changes Required

1. pkg/constants/version_constants.go — Update DefaultFirewallVersion from "v0.25.18" to "v0.25.19"
2. make build — Rebuild the binary (version constant is compiled in)
3. make recompile — Recompile all workflow lock files to pick up the new firewall image tag
4. make agent-finish — Full pre-commit validation

Notes

• Lock files referencing the firewall Docker image tag will be updated by make recompile
• The getAWFImageTag() helper strips the v prefix, so the Docker image tag becomes 0.25.19
• Check if the MCPG version also needs a coordinated bump