Fix large payload tester mount isolation - remove test data from gateway

[Copilot]

The large-payload-tester workflow had /tmp/mcp-test-fs (test data) mounted to the gateway container, breaking test isolation. The gateway should only access test files through the filesystem MCP server via protocol, not direct filesystem access.

Changes

• Removed test data mount from gateway: Gateway now only has /tmp/jq-payloads (payload dir) mounted, not /tmp/mcp-test-fs (test data)
• Removed payload directory pre-creation: Gateway creates /tmp/jq-payloads on-demand via MkdirAll when storing first payload
• Updated docs: Architecture diagram and isolation rationale

Technical Detail

Gateway uses Docker-in-Docker (socket mounted). When launching backend MCP servers:

# Gateway executes this command (runs on host Docker daemon)
docker run -v /tmp/mcp-test-fs:/workspace/test-data filesystem-mcp-server

The path /tmp/mcp-test-fs is relative to the host filesystem, not the gateway container's filesystem. Gateway container doesn't need this directory mounted to pass it to child containers.

Result

# Before (incorrect)
sandbox.mcp.mounts:
  - "/tmp/mcp-test-fs:/tmp/mcp-test-fs:ro"  # Gateway had direct access
  - "/tmp/jq-payloads:/tmp/jq-payloads:rw"

# After (correct)
sandbox.mcp.mounts:
  - "/tmp/jq-payloads:/tmp/jq-payloads:rw"  # Gateway only has payload dir

Test data isolation ensures the gateway must retrieve files via MCP protocol, properly testing payload interception and storage.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR fixes a mount isolation issue in the large-payload-tester workflow where test data was incorrectly mounted to the gateway container. The gateway uses Docker-in-Docker: when it launches backend MCP servers with volume mounts, the paths are relative to the host filesystem, not the gateway container's filesystem. Therefore, the gateway doesn't need test data mounted to pass it to child containers.

Changes:

• Removed /tmp/mcp-test-fs mount from gateway container's sandbox.mcp.mounts configuration
• Removed mkdir -p /tmp/jq-payloads from setup step (gateway creates this on-demand via MkdirAll)
• Updated documentation to explain the isolation architecture and Docker-in-Docker behavior

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/large-payload-tester.md	Removed test data mount from gateway, removed payload dir pre-creation, updated comment
.github/workflows/large-payload-tester.lock.yml	Compiled lock file with updated gateway Docker command and setup step
.github/workflows/large-payload-tester-README.md	Enhanced documentation with architecture diagram, flow description, and isolation principles
.github/agentics/large-payload-tester.md	Updated test protocol description to emphasize isolation and architecture

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.