[copilot-opt] Enforce MCP-only GitHub reads and detect direct gh/api.github.com access in Copilot runs
#27355
+0
−0