bug: tools.github: false does not override tools.github.* from a shared import

[yskopets]

Problem

When a workflow sets tools: github: false to explicitly disable the GitHub MCP tools, but also imports a shared workflow that sets tools: github: mode: remote, the false value is not respected — the GitHub MCP server is still configured in the compiled output.

Reproduction

Shared import (shared/side-repository.md):

tools:
  github:
    mode: remote

Importing workflow (my-workflow.md):

tools:
  github: false

imports:
  - shared/common.md
  - shared/side-repository.md

Expected: GitHub MCP tools disabled (tools.github: false takes precedence as the more specific, workflow-level override).

Actual: GitHub MCP tools remain enabled. The compiled .lock.yml includes the GitHub MCP server configuration with X-MCP-Toolsets: "context,repos,issues,pull_requests", as if false was never set.

Context

The SideRepoOps pattern recommends placing tools.github.mode: remote in a shared import so all side-repo workflows inherit it. However, some workflows in a side-repo setup legitimately don't need GitHub tools at all (e.g. they only process data from a checked-out repo without making GitHub API calls). These workflows should be able to opt out with tools: github: false, but currently cannot.

Expected Behaviour

tools: github: false at the importing workflow level should take precedence over any tools: github: * inherited from shared imports, consistent with the general principle that the importing workflow can override imported configuration.

---

This issue was filed by Claude Code.